Monitoring Splunk

how to get total hit count value for traffic passing through ANY ANY rule on firewall:

hadiamro
Engager

I have a firewall which have a rule with any as source destination and ports, I need to monitor this traffic and check what source and destination ips are passing through along with ports/service information. the following coorelation search provide me the perfect results but in huge events with multiple duplicate traffic, I don't want to use dedup command as if will miss some traffic.

index=paloalto-firewall host="firewall IP" rule="any any rule name" | table _time client_ip src_zone dest_ip dest_zone dest_port rule src_interface dest_interface action

Expected results I need as table: where as 555 is the total hits for this traffic passing through any any rule.

client_ip | src_zone | dest_ip | dest_zone | dest port |rule | src_interface | dest_interface | action |hit_counts
*192.168.1.1 | Inside_zone | 192.168.2.1 | dmz_zone | 80 | rulename | if1 | fi2 | allowed | 555
*

Any help would be greatly appreciated.

0 Karma
1 Solution

ashajambagi
Communicator

does using stats solve the problem?

index=paloalto-firewall host="firewall IP" rule="any any rule name" | stats count by client_ip src_zone dest_ip dest_zone dest_port rule src_interface dest_interface action

View solution in original post

ashajambagi
Communicator

does using stats solve the problem?

index=paloalto-firewall host="firewall IP" rule="any any rule name" | stats count by client_ip src_zone dest_ip dest_zone dest_port rule src_interface dest_interface action

View solution in original post

hadiamro
Engager

Thanks, it does provide the required results.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!