Question on the following SPL:
> index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port
This works well, but I'd also like to include the protocol in the output, so I know if the port is TCP or UDP. I've tried different things but no luck.
Is that even possible using this SPL?
You can write - index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port protocol
There are two ways to do that.
index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port protocol
index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) values(protocol) by dest_ip dest_port
Hi Rich, I had already tried the first one but it returns no statistics at all. The second one you suggested returns statistics, including a values(protocol) field, but that field is blank? Looking at the corresponding Event data I see strings in the entries for "stub TCP connection", "stub UDP connection" so the data seems to be there.
Thanks!
The fact that the first command returns nothing and the second returns an empty field tells me your data does not have a field called "protocol". It must be called something else. Look where you see "stub TCP connection" to get the correct field name.