topic Re: How to view the "others" in ACC Network Activity Source IP Activity in General Topics

How to view the "others" in ACC Network Activity Source IP Activity

MichaelMedwid — Wed, 10 Nov 2021 00:54:35 GMT

For the screen cap below I filtered the destination IP to one particular server.

This Source IP Network Activity widget is showing me the first 10 IPs that

talked to it. But then all the other sessions are summarized as "others".

I want to know all the IPs and to then export that information. Clicking

on "others" doesn't seem to do the trick. If I click the down arrow at the

right side of others I get four ghosted options. What's the mojo?

Re: How to view the "others" in ACC Network Activity Source IP Activity

LAYER_8 — Wed, 10 Nov 2021 01:03:54 GMT

The way most of my customers use this is using the global filter in the left side, adding "address, not in, _subnet_"

For example, sometimes their DC or critical infra showed the majority of data/traffic but they didn't want to always have the widgets display that, so they would exclude subnets/addresses from time to time.

Re: How to view the "others" in ACC Network Activity Source IP Activity

MichaelMedwid — Wed, 10 Nov 2021 01:16:17 GMT

Hmm - in the global filter on the left I see the option to choose say source address and a value. But there's no operator available like notin. I tried restricting filter to only include source zone. But that still left me with the "others". If there's some other way to get this info - custom reports or other - that would be just as good.

Re: How to view the "others" in ACC Network Activity Source IP Activity

MichaelMedwid — Wed, 10 Nov 2021 01:28:57 GMT

Oh - I found it. If I hover over the Expand button it says "Expand and show more data". And sure enough - it did just that. 🙂