Search for ports by host

[vumanhtai]

Hi All!
What search commands can I use to get results like this?

[woodcock]

Like this:

... | stats first(status) BY host port
| stats list(port) AS port list(status) AS status BY host

[niketn]

@vumanhtai, multiple ips can be connecting to same port. So ideally you should have the result other way around

 <YourBaseSearch>
| eval port_status=port." - ".status
| stats values(port_status) as port_status by host

[493669]

...|stats list(port) as port, list(status) as status by host

OR

...|stats values(port) as port, values(status) as status by host

You can try this...
list() does not dedup while values() will dedup