Hi, I'm running the below syntax on Splunk Enterprise to get traffic logs from Fortigate firewalls: index="fortinet" "devname=" "xxxxx-xxxxxx" "vd=" "xxx-xxxxx" policyid=5 action=accept | stats count by srcip, dstip, dstport, service, action, date, time, policyid | dedup srcip dstip dstport service consecutive=true | sort 0 field This gives me all TCP & UDP traffic, then I can download & filter in a .csv but doesn't pick up ICMP traffic (specifically icmp type 8). I have to run a separate syntax to get just ICMP as below: index="fortinet" "devname=" "xxxxx-xxxxxx" "vd=" "xxx-xxxxx" policyid=5 action=accept | stats count by srcip, dstip, service, action, date, time, policyid | dedup srcip dstip service consecutive=true | sort 0 field It seems that because ICMP has no dstport the syntax needs adjusting. I need is a syntax that will return all traffic, i.e. TCP, UDP & ICMP. Please advise? Naz ... View more