A method in a first network device in a network comprising of the first network device and a second network device , both the first network device and the second network device communicatively coupled to a third network device , for aggregating Internet Protocol, IP, traffic in the network by utilizing a big data tool in a distributed manner, the method comprising: receiving IP traffic from only a first portion of the network, wherein IP traffic from a second portion of the network is received by the second network device ; utilizing a big data tool to generate a summary of the IP traffic from the first portion of the network, wherein a summary of the IP traffic from the second portion of the network is generated by the second network device utilizing its local big data tool , wherein generating the summary of the IP traffic from the first portion of the network comprises: for each IP data of the IP traffic, accessing a set of fields from the received IP data, determining a key field based on one or more fields from the set of fields, determining a value field based on one or more fields from the set of fields; and partitioning the set of fields into groups based on key fields, wherein each group includes a unique key field and one or more value fields from one or more IP data having the same key field; sending the summary of the IP traffic of the first portion of the network to the third network device , causing the third network device to utilize its local big data tool to generate a summary of the IP traffic of the first portion and the second portion of the network based on the summary from the first network device and the summary from the second network device , thereby allowing analysis of the IP traffic in the network to be distributed between the first, the second, and the third network devices. receiving IP traffic from only a first portion of the network, wherein IP traffic from a second portion of the network is received by the second network device ; utilizing a big data tool to generate a summary of the IP traffic from the first portion of the network, wherein a summary of the IP traffic from the second portion of the network is generated by the second network device utilizing its local big data tool , wherein generating the summary of the IP traffic from the first portion of the network comprises: for each IP data of the IP traffic, accessing a set of fields from the received IP data, determining a key field based on one or more fields from the set of fields, determining a value field based on one or more fields from the set of fields; and partitioning the set of fields into groups based on key fields, wherein each group includes a unique key field and one or more value fields from one or more IP data having the same key field; for each IP data of the IP traffic, accessing a set of fields from the received IP data, determining a key field based on one or more fields from the set of fields, determining a value field based on one or more fields from the set of fields; and partitioning the set of fields into groups based on key fields, wherein each group includes a unique key field and one or more value fields from one or more IP data having the same key field; sending the summary of the IP traffic of the first portion of the network to the third network device , causing the third network device to utilize its local big data tool to generate a summary of the IP traffic of the first portion and the second portion of the network based on the summary from the first network device and the summary from the second network device , thereby allowing analysis of the IP traffic in the network to be distributed between the first, the second, and the third network devices. <EOS>