topic Re: Count matching values on seperated fields in Splunk Search

Count matching values on seperated fields

Aufex — Tue, 29 Sep 2020 15:10:43 GMT

Hi there,
i try to buildup a firewall report:

"sourcetype="firewall" action=blocked | table host src dest src_port dest_port"

this gives me endless rows, and many of them are dublicated.
i try to delete all the dublicates and count them so that i have something like

that would give a nice overview.

Re: Count matching values on seperated fields

knielsen — Tue, 01 Aug 2017 08:13:25 GMT

The simplest solution is to do a count by the fields you are interested in. It might still be very cluttered I guess, I assume SRC_PORT will vary a lot?

sourcetype="firewall" action=blocked | stats count by host src dest src_port dest_port

Re: Count matching values on seperated fields

Aufex — Tue, 01 Aug 2017 08:17:39 GMT

thank you. yes ports change a lot. i think its much smarter to display the zones 🙂

Re: Count matching values on seperated fields

woodcock — Wed, 02 Aug 2017 03:13:57 GMT

Don't forget to click Accept to close the question.