I do not think i have the input yet. i am hoping that the Splunk add-on for MS Windows will help with this. ... View more

yes src_ip and dst_ip are in the same event src_ip=111.111.111.111 OR src_ip=222.222.222.222 OR src_ip=333.333.333 type=TRAFFIC | top 10 dst_ip results in 10 ip addresses...and clicking on the ip address will show the events for each of the addresses in the search and some additional addresses...so that is almost it ( not exclusive to the three listed ips) ... View more

thanks for your responses.... so new to complex searches... Restating the scenario: Using the firewall logs, I am trying to find common website/destination IP that 3 known users have in common...due to bad guy activity on the src_IP, like malware So I could set a custom filter for the block of time...to remove that complexity. I tried the following - no results src_ip=111.111.111.111 OR src_ip=222.222.222.222 OR src_ip=333.333.333 type=TRAFFIC | bucket span=2d _time | stats dc(src_ip) as ips by dest_ip The following had 12000 events no matches...But I know they all three had gone to the same dst_ip in the last 2 hours... src_ip=111.111.111.111 OR src_ip=222.222.222.222 OR src_ip=333.333.333 type=TRAFFIC | bucket span=120m _time | stats dc(src_ip) as ips by dest_ip I tried the following custom time set - no results src_ip=111.111.111.111 OR src_ip=222.222.222.222 OR src_ip=333.333.333 type=TRAFFIC | stats dc(src_ip) as ips by dest_ip I tried the following custom time set - Error in Stats command (ip=111.111.111.111 OR src_ip=222.222.222.222 OR src_ip=333.333.333) type=TRAFFIC | stats count(src_ip) as COUNT dst_ip src_ip The following with custom time set results in 10085 (ip=111.111.111.111 OR src_ip=222.222.222.222 OR src_ip=333.333.333) type=TRAFFIC| stats count(src_ip) as COUNT ... View more

The default search looks at logs posted to 'Main' Index. If you put the ASA logs into another index it does not show up. Changes to what index is used is under Access Control/Roles change each account type, for example User check under "Indexes searched by default" add other logs as needed ... View more