https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-connection-data-for-firewall-cleanup/m-p/479054#M7628 <P>who does ip xxx connect to and on what port...</P> <PRE><CODE> index=Your_index sourcetype="pan:traffic" src_ip="x.x.x.x" | stats count by dest_ip dest_port </CODE></PRE> <P>who connects to ip xxx and on what port...</P> <PRE><CODE> index=Your_index sourcetype="pan:traffic" dest_ip="x.x.x.x" | stats count by src_ip src_port </CODE></PRE> Fri, 03 Jan 2020 19:44:31 GMT mydog8it 2020-01-03T19:44:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-connection-data-for-firewall-cleanup/m-p/479053#M7627 <P>Hi Forum,<BR /> I am in the process of cleaning up some old rules on our Palo Altos. The custom search function in the firewall is very slow. I would like to leverage our Splunk environment to spped up the data collection. What I am looking for is:<BR /> -) who does ip xxx connect to and on what port<BR /> -) who connects to ip xxx and on what port<BR /> Thank You<BR /> Ron</P> Fri, 03 Jan 2020 19:12:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-connection-data-for-firewall-cleanup/m-p/479053#M7627 rclifford 2020-01-03T19:12:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-connection-data-for-firewall-cleanup/m-p/479054#M7628 <P>who does ip xxx connect to and on what port...</P> <PRE><CODE> index=Your_index sourcetype="pan:traffic" src_ip="x.x.x.x" | stats count by dest_ip dest_port </CODE></PRE> <P>who connects to ip xxx and on what port...</P> <PRE><CODE> index=Your_index sourcetype="pan:traffic" dest_ip="x.x.x.x" | stats count by src_ip src_port </CODE></PRE> Fri, 03 Jan 2020 19:44:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-connection-data-for-firewall-cleanup/m-p/479054#M7628 mydog8it 2020-01-03T19:44:31Z