How to edit my search to find different ports used per IP and their count?

[lakromani]

I have am looking data from out firewall.
There I have a search that gives me a list of all allowed traffic to all IP in our c range.

I would like to get a list of hits per port per IP like this:

dest_ip        port     hits
75.75.75.1      80      50
                  443      200
75.75.75.22    21       354
                  80        65
                  8080    125
75.75.75.65    80       45
                  443      2

If I do like this:

my search  |  stats values(dest_port) dc(dest_port) by dest_ip

I get the count of different type of ports, not number of hits per ports like this:

dest_ip        port     hits
75.75.75.1      80      2
                  443
75.75.75.22    21       3
                  80
                  8080
75.75.75.65    80       2
                  443

This:

my search  |  stats values(dest_port) count(dest_port) by dest_ip

seem to give me the total hits for all packets per host, not per port per ip

[somesoni2 · Accepted solution]

The expected output requires two stats commands, like this

 my search | stats  count by dest_ip,dest_port | stats list(dest_port) as port list(count) as hits by dest_ip

[lakromani]

This was just what I needed. Thanks.