Trying to create a Cisco ASA firewall dropping table



1 comment

  • Avatar
    David Marcoux

    Hi Brannen,

    To achieve the "running list" type of display that you want you could add _messagetime as one of your fields. This basically ensures that log data isn't rolled up.

    Try something like this:
    | parse using public/cisco/asa
    | count desthost,srchost,dest_port,_messagetime
    | sort _messagetime desc
    | fields -_messagetime

    Comment actions Permalink

Please sign in to leave a comment.