How do I improve my search for outbound traffic to determine source, destination IP and destination port?

[pandeyashish]

I am trying to make a search for outbound traffic flow. i.e. source, destination IP and destination port. Is there any way to improve this search as it's currently breaking my search head and the performance is not as expected.

index=* sourcetype=* | stats values(dest_ip) values(dest_port) by src_ip

Your feedback and advice is much appreciated.
Thanks,

[sundareshr]

does this give you what you need?

index=firewall sourcetype=* src_ip=* | table src_ip dest_ip dest_port

[pandeyashish]

Thanks for the reply Sundaresh, I have used this query, since this is for firewall logs this query is using too long to execute the result. So I have to break down the time range. Do you have any suggestions based on index summary. The current query that I am using is
index=firewall sourcetype=* action="allowed" NOT dest_ip="10...*" NOT dest_port="443" NOT dest_port="80" | sistats count by src_ip dest_ip dest_port

Any feedback on this would help me to work on my assigned engagements 🙂
Thanks,

[pandeyashish]

index=firewall sourcetype=* | stats values(dest_ip) values(dest_port) by src_ip
This search is to find all the source and destination IPs with destination port.