Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
itismo
New Contributor

Dataset to list unique number of source IPs next to each destination IP

Hello,

 

I am trying to create a Dataset to list the number of unique source IPs which communicated with each destination IP but for some reason it is not working, i already have a good Dataset with all destination IPs and the total number of sessions, now i need to add a column with the number of unique source IPs.

 

It also would be optimal solution for me to have the destination ports and policy IDs for each IP destination IP address grouped together in the same row separated by commas so the end result is one row for each destination IP.

 

Should i create two tables and merge them at the end?

 

Good Dataset:

select dstip, dstport, policyid, count(*) as total_num from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and action = 'accept' group by dstip, dstport, policyid order by total_num desc

 

Not working Dataset:

select count(DISTINCT srcip) as srcip_count, dstip, dstport, policyid, count(*) as total_num from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and action = 'accept' group by srcip_count, dstip, dstport, policyid order by total_num desc

 

Note: For technical reasons I am not able to use the "Test" button to test my queries.

0 REPLIES 0
Labels
Top Kudoed Authors