How to get the total bandwidth

[mohamedapa]

I have fortianalyzer D200 v5.2.1 i have the below dataset i need to edit it to sum the total bandwidth per user,

select from_dtime(dtime) as timestamp, catdesc, hostname as website,srcip as SourceIP, sum(bandwidth) as bandwidth from (###(select dtime, catdesc, hostname,srcip, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and hostname is not null and logid_to_int(logid) not in (4, 7, 14) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', ' scrip-filter') group by dtime, catdesc, hostname,srcip order by dtime desc)### union all ###(select dtime, catdesc, hostname, srcip, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where $filter and hostname is not null and (eventtype is null or logver=52) group by dtime, catdesc, hostname, srcip order by dtime desc)###) t group by dtime, catdesc, website, SourceIP order by dtime desc

[hzhao_FTNT]

Please do not include "dtime, catdesc, hostname" in your query if you need total bandwidth. Your query should be:

select srcip as SourceIP, sum(bandwidth) as bandwidth from (###(select srcip, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and logid_to_int(logid) not in (4, 7, 14) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', ' scrip-filter') group by srcip order by bandwidth desc)### union all ###(select srcip, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where $filter and (eventtype is null or logver=52) group by  srcip)###) t group by SourceIP order by bandwidth desc