I would like to know if there is a way to get true/false match on source IP to see tor sourced traffic over time in a time chart.
You can place the TOR exit node list into a CSV then at search time use an inputlookup like so:
index=firewall [|inputlookup torexitnodes.csv | fields exitnodeip ]
Because Tor exit nodes change constantly you will probably need to have this CSV automatically updated by a script.
Can you please suggest from where can we download the latest tor exit nodes IP details. Thanks in advance
If you haven't found a good place for tor exit nodes, http://iplists.firehol.org/ is a great resource.