I am quite new to Splunk search query. I have collected traffic logs from paloalto firewall. I want to have the Top 10 user monthly report which sum up the total byte size and sessions by a month. I have done the below search to get our expected result. index=pan_logs sourcetype=pan_traffic | stats sum(bytes) as totalbytes, count(session_id) as Sessions by src_user | eval "Total Size"= formatbytes(totalbytes) | sort -totalbytes | table src_user "Total Size" Sessions | head 10 On the other way, I need to divided the results by days. The below search a specific user and divides the total bytes and sessions per day. index=pan_logs sourcetype=pan_traffic src_user="user1" | eval time=strptime(generated_time,"%Y/%m/%d %H:%M:%S")| bucket time span=1d | stats sum(bytes) as totalbytes, count(session_id) as Sessions by time | eval "Total Size"= formatbytes(totalbytes) | eval Date=strftime(time, "%d/%m/%Y") | sort -Date | table Date "Total Size" Sessions I would like the 2nd search to know the TOP 10 users and get the result of "divided by date" on that TOP 10 users. My wordings seems confusing. What i need to achieve is to get Monthly Top 10 Users and their total size and sessions per day. Can anyone give me some hints on it? Thanks in advance. ... View more