I have several firewall appliances logging into one syslog file and would like to report on the number of SSH login attempts by the external source IP. The fields are a little different from typical syslog format. The appliances do not have the same rule base, so I can't key on rule number.
May 25 07:20:53 10.1.2.3 2011: May 25 15:37:39 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:18.104.22.168 SPort:2624 Dst:22.214.171.124 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)
May 25 07:20:54 10.1.2.3 2011: May 25 15:37:40 fw_appl <50000> Dropped Inbound packet (Policy rule) Src:126.96.36.199 SPort:2639 Dst:188.8.131.52 DPort:22 IPP:6 Rule:21 Interface:WAN (Internet)
How about this:
"Dropped Inbound packet" Interface="WAN (Internet)" DPort=22 NOT Src=10.* NOT Src=192.168.* | stats count by host, Src
This search assumes that all the fields in your syslog message are extracted by Splunk.
it seems to track the device IP address as the host, instead of Src:x.x.x.x -- when I go to report I see the fw appliance and the count of ssh logins without tracking how many times the foreign address attempted