SQL where clause effect on table?
You are doing a sum() which means you "lose" the original values -- they are aggregated.

By applying a where clause, you filter rows before the aggregation phase.

I suspect what you want is a having clause, something like:

select sourceIP, sum(sourceBytes) 
from flows
group by sourceIP
having sum(sourceBytes) &gt; 50 
order by sum(sourceBytes) desc;


Having is like a where but applied to the aggregated results.

Note that you can also use a subquery and a where instead of having as follows:

select * from (
  select sourceIP, sum(sourceBytes) as sum_sourceBytes 
  from flows
  group by sourceIP
) a
where sum_sourceBytes &gt; 50
order by sum_sourceBytes desc;