Trying to create a Cisco ASA firewall dropping table

Answered

Comments

1 comment

  • Avatar
    David Marcoux

    Hi Brannen,

    To achieve the "running list" type of display that you want you could add _messagetime as one of your fields. This basically ensures that log data isn't rolled up.

    Try something like this:
    _souceCategory=asa
    | parse using public/cisco/asa
    | count desthost,srchost,dest_port,_messagetime
    | sort _messagetime desc
    | fields -_messagetime

Please sign in to leave a comment.