I have the following query for PAN firewall logs:
index=pan app=ssl
| stats count by src
This would give me a list of all src IPs of devices that use SSL. How would I create a query to give me the opposite results? I want the list of src IPs that never have SSL traffic.
Here's one way:
index=pan app=*
| stats count by src app
| where app!="ssl"
Here's another:
index=pan app!="ssl"
| stats count by src
I am looking to list all src's that do not use ssl. Your query basically gives me the same results because all src's use multiple apps.
Is there a way to do this without me doing a massive diff of tens of thousands of results?
Try this
index=pan app=*
| stats count values(app) as app by src
| where NOT (app="ssl")