topic need help writing firewall log search command in Splunk Enterprise Security

need help writing firewall log search command

nithin_45_10 — Sun, 07 Jun 2020 16:15:17 GMT

hi ,

I need help writing a query to fetch the details for the below mentioned logic

For the firewall logs, accept events from same source IP more than 100 times, to more than 3 destination IP

Thanks

richgalloway — Thu, 07 May 2020 13:02:42 GMT

Perhaps this will help.

index=firewall | stats count dc(dst_ip) as dst_count by src_ip | where (count > 100 AND dst_count > 3)