I have firewall logs coming in. I have a field which is the destination of traffic (dst). I would like to show the total count of the destination field and the count of the unique sources.
So the result would be:
Dst Total Events Sources
8.8.8.8 50 25
8.8.8.9 40 35
8.8.8.10 150 95
Im guessing this was the best way.
I think this does it. Ive done some checks and it appears the numbers line up. Is there a better way or more efficient query I could have written?
dst=* | stats count(dst), dc(host) by dst | sort -num("dc(host)") | rename dst as "Destination IP", count(dst) as "Total Count", dc(host) as "Total Locations"