Identify the top 10 source IP addresses by Bandwidth Usage

Use this query template to sum all bytes used by Source IP. You can easily replace Source IP by user, country, or any other field you want to group by.

_sourceCategory=Apache/Access 
| sum(size) as total_bytes by src_ip 
| top 10 src_ip by total_bytes