_index=security_logs _sourceCategory=fw_security "type=\"traffic\""
  | keyvalue regex "=(\d+)" keys "sentbyte", "rcvdbyte" as bsnt, brec
  | brec+bsnt as bTot
  | timeslice 5m
  | sum(btot) as bytes by _timeslice,_sourceHost
  | (bytes/1000000) as mbytes
  | fields - bytes
  | transpose row _timeslice column _sourceHost as *