Need connection data for firewall cleanup

[rclifford]

Hi Forum,
I am in the process of cleaning up some old rules on our Palo Altos. The custom search function in the firewall is very slow. I would like to leverage our Splunk environment to spped up the data collection. What I am looking for is:
-) who does ip xxx connect to and on what port
-) who connects to ip xxx and on what port
Thank You
Ron

[mydog8it]

who does ip xxx connect to and on what port...

   index=Your_index sourcetype="pan:traffic" src_ip="x.x.x.x" | stats count by dest_ip dest_port

who connects to ip xxx and on what port...

   index=Your_index sourcetype="pan:traffic" dest_ip="x.x.x.x" | stats count by src_ip src_port