Splunk Enterprise Security

need help writing firewall log search command

New Member

hi ,

I need help writing a query to fetch the details for the below mentioned logic

For the firewall logs, accept events from same source IP more than 100 times, to more than 3 destination IP


Labels (1)
0 Karma


Perhaps this will help.

index=firewall | stats count dc(dst_ip) as dst_count by src_ip | where (count > 100 AND dst_count > 3)
If this reply helps you, an upvote would be appreciated.
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!