How do I get a report running with cumulative stats?

[pbdiggins]

I run a stats command every hour to show a list of firewall rules that are getting hit in a particular way. My command works for the hourly run, but I can't get a report to keep a running total of my firewall rule hit count. I've tried the following, but it's not working. Can anyone help here?

index=rsyslog firewall-ABC [search index=rsyslog (IONET_allow_BLAH_in OR IONet_allow_BLAH_outbound) host=firewall_XYZ.nascom.nasa.gov | table source_address, destination_address, destination_port] NOT (policy_id=1 OR policy_id=2)| sistats count by policy_id, source_address, destination_address | summaryindex spool=t uselb=t addtime=t index="summary" file="RMD5eef7b35350423340_1029407874.stash_new" name="Delegation_Fails" marker=""

Thanks,

Paul

[richgalloway]

That query will produce hourly stats and write them to a summary index.  To get cumulative stats, read from the summary index.

index="summary" file="RMD5eef7b35350423340_1029407874.stash_new" name="Delegation_Fails" marker=""
| stats count by policy_id, source_address, destination_address 

[pbdiggins]

Thanks for your reply, but I don't quite understand.

I'm running this as a report hourly,  how would I use this to accomplish my goals? I don't understand the change in the index...  When I try to run the command as you posted, I get no results within the default time window. I expand the time window to "all time" and still nothing.

Sorry. I'm new to this.. Thanks.

[richgalloway · Accepted solution]

You have an hourly report that writes data to a summary index.  To get a roll-up, run a separate report that reads from the summary index.

I may have given you a command that is too specific.  Try this

index="summary" search_name=<<your hourly report name>>
| stats count by policy_id, source_address, destination_address

[pbdiggins]

Thank you very much... That was the ticket!!