Thx for your response.
I would like to add another column. It is the separator to use ? this "|"
for exemple:
sourcetype=mynetworkdata |
stats sum(sent_bytes) as send by src_ip_addr (column 1) | sort - send
stats sum(rcvd_bytes) as receive by src_ip_addr (column 2) | sort - receive
| head 5
... View more