Something aking to | sort | uniq -c | sort -nr

Jack45 — Tue, 28 Sep 2021 07:08:33 GMT

Like the title says, is there a way to run a filter for a period of time, pull out a list of IPs, sort them, remove the duplicates with a count, and sort them by most popular?

This is a common omegle thing to do with syslog data, say you have a very permissive rule and you want to see what source IPs are being used by that rule. You could awk print the source IP column and filter it accordingly. How are you folks working with data like this?

azar

Thanks

Re: Something aking to | sort | uniq -c | sort -nr

Retired Member — Mon, 27 Sep 2021 13:36:27 GMT

@jackd I presume you are referring to the traffic log query engine on the farewell/Panorama and yes, it is not very advanced and distinct or uniq function are definitely missing.

We use external SIME solution with advanced queries capabilities, but for a small tasks I would export the logs and use Unix or some script to query them. You can also use the firewall local reporting engine to generate something similar. For example you can create a report on only unique source IPs hit count over a period of time, but this also has its limitation.

topic Re: Something aking to | sort | uniq -c | sort -nr in General Topics

Something aking to | sort | uniq -c | sort -nr

Re: Something aking to | sort | uniq -c | sort -nr