Monitoring Splunk

how to get total hit count value for traffic passing through ANY ANY rule on firewall:

hadiamro
Engager

I have a firewall which have a rule with any as source destination and ports, I need to monitor this traffic and check what source and destination ips are passing through along with ports/service information. the following coorelation search provide me the perfect results but in huge events with multiple duplicate traffic, I don't want to use dedup command as if will miss some traffic.

index=paloalto-firewall host="firewall IP" rule="any any rule name" | table _time client_ip src_zone dest_ip dest_zone dest_port rule src_interface dest_interface action

Expected results I need as table: where as 555 is the total hits for this traffic passing through any any rule.

client_ip | src_zone | dest_ip | dest_zone | dest port |rule | src_interface | dest_interface | action |hit_counts
*192.168.1.1 | Inside_zone | 192.168.2.1 | dmz_zone | 80 | rulename | if1 | fi2 | allowed | 555
*

Any help would be greatly appreciated.

0 Karma
1 Solution

ashajambagi
Communicator

does using stats solve the problem?

index=paloalto-firewall host="firewall IP" rule="any any rule name" | stats count by client_ip src_zone dest_ip dest_zone dest_port rule src_interface dest_interface action

View solution in original post

ashajambagi
Communicator

does using stats solve the problem?

index=paloalto-firewall host="firewall IP" rule="any any rule name" | stats count by client_ip src_zone dest_ip dest_zone dest_port rule src_interface dest_interface action

hadiamro
Engager

Thanks, it does provide the required results.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...