Specifically, I am attempting to gather a count of firewall denies per day over an entire month. Running that search takes quite a long time. I am wondering if there is a more efficient way to perform this search than just performing the search and waiting for the results.
sourcetype=cisco_asa eventtype=cisco_firewall eventtype=firewall_deny | count by dest_ip
Is there a way to run the search for a one day period and store the count in a csv and then pull from the csv? Or is there something else?
