How do I create a Firewall Report with Both Destination IP and Destination Port?

[jraquino]

I would like to know how to create a Firewall Deny Report that looks like this.

[fwilmot]

Hey JR- one way to do that is to do a statistical count of destination ports and destination IPs that have been denied, then chart a sum by the destination ports and destination IPs as they apply.
sourcetype="firewall" action=deny | stats count by dst dst_port | chart sum(count) by dst dst_port. the fields will depend on your extracted fields, but give that a shot, it should do the trick.

[lbogle]

Any idea on how to use the output of that report but limit the number of IP's to say 5-10 and list them along the bottom?