Solved: 10 TCP ports accessed by unique clients - Splunk Community

Splunk Search

I am trying to search List the top 10 TCP ports accessed by unique IPs

1 Solution

Solution

index=firewall 
    [ search index=firewall 
    | top limit=10 dest_port 
    | table dest_port ] 
| stats values(dest_port) as "Top 10 Ports" count by src_ip

View solution in original post

Solution

index=firewall 
    [ search index=firewall 
    | top limit=10 dest_port 
    | table dest_port ] 
| stats values(dest_port) as "Top 10 Ports" count by src_ip

Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...