https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607205#M211115 <P>Hi,</P> <P>I have about 100 rules and I want to count the number of logs are related to each rule.</P> <P>When I used "stats count" it counted those rules that have 1 or more logs, but didn't show all the rules with zero hits.</P> <P>I tried to import csv file that contains all the rules and to remove the rows that contains rules with 1 or more hits.</P> <P>Moreover, I tried the suggestion&nbsp;here with no luck:</P> <P><A href="https://community.splunk.com/t5/Splunk-Search/Using-Splunk-to-Find-Unused-Firewall-Policies/m-p/32802" target="_blank" rel="noopener">Solved: Using Splunk to Find Unused Firewall Policies - Splunk Community</A></P> <P>Any suggestion?</P> <P>Thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 27 Jul 2022 14:47:55 GMT joock3r 2022-07-27T14:47:55Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607205#M211115 <P>Hi,</P> <P>I have about 100 rules and I want to count the number of logs are related to each rule.</P> <P>When I used "stats count" it counted those rules that have 1 or more logs, but didn't show all the rules with zero hits.</P> <P>I tried to import csv file that contains all the rules and to remove the rows that contains rules with 1 or more hits.</P> <P>Moreover, I tried the suggestion&nbsp;here with no luck:</P> <P><A href="https://community.splunk.com/t5/Splunk-Search/Using-Splunk-to-Find-Unused-Firewall-Policies/m-p/32802" target="_blank" rel="noopener">Solved: Using Splunk to Find Unused Firewall Policies - Splunk Community</A></P> <P>Any suggestion?</P> <P>Thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 27 Jul 2022 14:47:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607205#M211115 joock3r 2022-07-27T14:47:55Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607206#M211116 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/248051">@joock3r</a>,</P><P>you have to put the firewall rules in a lookup (called e.g. firewall_rules.csv) containing at least one field (called rule).</P><P>In the firewall events you extracted a field called rule whose contents should match the lookup.</P><P>In this case, you could run this search to identify the not used ones.</P><LI-CODE lang="markup">index=your_index rule=* | eval rule=lower(rule) | stats count BY rule | append [ | inputlookup firewall_rules.csv | eval rule=lower(rule), count=0 | fields rule count ] | stats sum(count) AS total BY rule | where total=0</LI-CODE><P>In this way you'll have the missing rules.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 27 Jul 2022 13:59:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607206#M211116 gcusello 2022-07-27T13:59:36Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607335#M211159 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>&nbsp;</P><P>Works like a charm. Thanks!</P> Thu, 28 Jul 2022 09:38:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607335#M211159 joock3r 2022-07-28T09:38:10Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607344#M211162 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/248051">@joock3r</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated by all the contributors <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 28 Jul 2022 10:55:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-unused-FW-rules/m-p/607344#M211162 gcusello 2022-07-28T10:55:30Z