Hello,
I am trying to create a Dataset to list the number of unique source IPs which communicated with each destination IP but for some reason it is not working, i already have a good Dataset with all destination IPs and the total number of sessions, now i need to add a column with the number of unique source IPs.
It also would be optimal solution for me to have the destination ports and policy IDs for each IP destination IP address grouped together in the same row separated by commas so the end result is one row for each destination IP.
Should i create two tables and merge them at the end?
Good Dataset:
select dstip, dstport, policyid, count(*) as total_num from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and action = 'accept' group by dstip, dstport, policyid order by total_num desc
Not working Dataset:
select count(DISTINCT srcip) as srcip_count, dstip, dstport, policyid, count(*) as total_num from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and action = 'accept' group by srcip_count, dstip, dstport, policyid order by total_num desc
Note: For technical reasons I am not able to use the "Test" button to test my queries.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1720 | |
1095 | |
752 | |
447 | |
234 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.