Can you help me with the following SPL: Index=fw_cisco

[dkraut]

Question on the following SPL:

 >  index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port

This works well, but I'd also like to include the protocol in the output, so I know if the port is TCP or UDP. I've tried different things but no luck.

Is that even possible using this SPL?

[Vijeta]

You can write - index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port protocol

[richgalloway]

There are two ways to do that.

index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) by dest_ip dest_port protocol

index=fw_cisco src_ip="1.2.3.4" | stats count(dest_port) values(protocol) by dest_ip dest_port

[dkraut]

Hi Rich, I had already tried the first one but it returns no statistics at all. The second one you suggested returns statistics, including a values(protocol) field, but that field is blank? Looking at the corresponding Event data I see strings in the entries for "stub TCP connection", "stub UDP connection" so the data seems to be there.

Thanks!

[richgalloway]

The fact that the first command returns nothing and the second returns an empty field tells me your data does not have a field called "protocol". It must be called something else. Look where you see "stub TCP connection" to get the correct field name.