Thank you!! So to double check I'm trying to get the total number of distinct source Ips, the total Kbps, and then divide the Total Kbps by the Count of src_ips (users). I tried this, but it doesn't work index="myIndex" source="tcp:xxxx" | bin _time span=5m | dedup src_ip _time **some intervals have more than one source IP, so I either want to get rid of it, or somehow add those bytes up as one number - but, if I have to, I'm okay with just using one occurrence in the 5 min. interval | stats count(src_ip) as NumUser ** then I'm trying to get a total number of users for the 5 minutes | eval TotalBytes = sum(cs_bytes) ** summarize the total number of bytes for the period | eval TotalKbps = (((TotalBytes*8)/1000)/300) | eval UtilPerUser = TotalKbps/NumUser | table _time, src_ip TotalKbps UtilPerUser TotalBytes It's not working - I think I know why, but can't figure out another way... any suggestions would be most welcome!! Thank you again!!
... View more