How about this?
sourcetype=mynetworkdata | stats sum(sent_bytes) as send sum(rcvd_bytes) as receive by src_ip_addr (column 1) | sort - send,receive | head 5
How about this?
sourcetype=mynetworkdata | stats sum(sent_bytes) as send sum(rcvd_bytes) as receive by src_ip_addr (column 1) | sort - send,receive | head 5
Thx for your response.
I would like to add another column. It is the separator to use ? this "|"
for exemple:
sourcetype=mynetworkdata |
stats sum(sent_bytes) as send by src_ip_addr (column 1) | sort - send
stats sum(rcvd_bytes) as receive by src_ip_addr (column 2) | sort - receive
| head 5
I was with you until you started asking about "count", as that comes with no context. The first part of your question is probably:
sourcetype=mynetworkdata | stats sum(bytes) as bytes by src_ip_addr | sort - bytes | head 5
You're looking for a search query to get the information which can be used in form of table graph? (the command line in the question is just confusiong).
Have a look at this as well. http://answers.splunk.com/answers/138212/top-10-ip-along-w-top-4-ports