I am trying to run a search that shows how many unique ports a particular IP address access in a day over a seven pay period
I am using the following search:
index=***** | timechart span=1d dc(dest_port) by src_ip
This seems to get me the correct information, but it would be a lot more useful if I could have the time as the header and the list of IP's going vertical. This way I could see a lot more information. The current search only shows me 10 IP addresses and groups the rest into an "OTHER" column.
Thanks
You should use "useother" option.
index=* | timechart span=1d dc(dest_port) by src_ip useohter=false
OR
index=* | timechart span=1d dc(dest_port) by src_ip | sort 100
Good day!