you could try something with streamstats maybe? host=$field1$ sourcetype=fgt_traffic "user=" service=HTTPS (app=dropbox OR app=slack OR app=trello OR app=hightail OR app=icloud OR app=box OR app=evernote OR app=salesforce OR app=google*docs OR app=google*drive OR appcat="Storage.Backup" OR appcat=Collaboration NOT "Microsoft" NOT "Skype" NOT "OneDrive" NOT "Wikipedia") | streamstats sum(BytesOUT_to_Megabytes) as Total by user | stats sum(BytesOUT_to_Megabytes) as "MB Sent" max(Total) as Total by user,app ... View more