I have am looking data from out firewall.
There I have a search that gives me a list of all allowed traffic to all IP in our c range.
I would like to get a list of hits per port per IP like this:
dest_ip port hits
75.75.75.1 80 50
443 200
75.75.75.22 21 354
80 65
8080 125
75.75.75.65 80 45
443 2
If I do like this:
my search | stats values(dest_port) dc(dest_port) by dest_ip
I get the count of different type of ports, not number of hits per ports like this:
dest_ip port hits
75.75.75.1 80 2
443
75.75.75.22 21 3
80
8080
75.75.75.65 80 2
443
This:
my search | stats values(dest_port) count(dest_port) by dest_ip
seem to give me the total hits for all packets per host, not per port per ip
The expected output requires two stats commands, like this
my search | stats count by dest_ip,dest_port | stats list(dest_port) as port list(count) as hits by dest_ip
The expected output requires two stats commands, like this
my search | stats count by dest_ip,dest_port | stats list(dest_port) as port list(count) as hits by dest_ip
This was just what I needed. Thanks.