https://community.splunk.com/t5/Getting-Data-In/Cisco-pix-ports-report/m-p/48377#M9168 <P>Hi,<BR /> I need to know what ports are actualy being uside on my Pix firewall.<BR /> How do I generate a report for all ports used (one for inside interface and one for outside)including source and destination IP addresses.</P> Fri, 31 Aug 2012 12:06:03 GMT pcarron 2012-08-31T12:06:03Z https://community.splunk.com/t5/Getting-Data-In/Cisco-pix-ports-report/m-p/48377#M9168 <P>Hi,<BR /> I need to know what ports are actualy being uside on my Pix firewall.<BR /> How do I generate a report for all ports used (one for inside interface and one for outside)including source and destination IP addresses.</P> Fri, 31 Aug 2012 12:06:03 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-pix-ports-report/m-p/48377#M9168 pcarron 2012-08-31T12:06:03Z https://community.splunk.com/t5/Getting-Data-In/Cisco-pix-ports-report/m-p/48378#M9169 <P>You should probably look at the <A href="http://splunk-base.splunk.com/apps/22300/cisco-security-suite">Cisco Security Suite App</A>, and <A href="http://splunk-base.splunk.com/apps/22303/splunk-for-cisco-firewalls">Splunk for Cisco Firewalls App</A>.</P> <P>Alternatively if you want to create you own....</P> <P>Without seeing the data... I imagine that you will just need to define your fields (where they have not already been extracted. (guide here)</P> <P>You will then probably need to use a stats command on the data (one for internal zones, one for external zones). This would be something like (depending on the fields you have extracted).</P> <PRE><CODE>sourcetype=ciscoPix | stats count by port srcIP dstIP </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Stats">http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Stats</A></P> <P>Or you could use things like <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top">top</A>.</P> Fri, 31 Aug 2012 13:56:02 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-pix-ports-report/m-p/48378#M9169 MHibbin 2012-08-31T13:56:02Z