Yes, of course, you need this:
index=pan_logs sourcetype=pan_traffic src_zone=ClientVPNZone OR src_zone=trust dst_zone=Untrust $location$ | eval mbits_sec_down=(bytes_received/elapsed_time)*8/1000/1000 | eval mbits_sec_up=(bytes_sent/elapsed_time)*8/1000/1000 | bucket _time span=1s | stats sum(mbits_sec_down) AS Down, sum(mbits_sec_up) AS Up by _time host | stats max(*) by host
Which I see @somesoni2 has already noted (what he said).
... View more