Tag: Splunk

src_ip=IP | stats count earliest(_time) AS Earliest, latest(_time) AS Latest by src_ip dest_ip action wanin wanout lanin lanout | eval Earliest=strftime(Earliest,"%Y-%m-%d %H:%M:%S") | eval Latest=strftime(Latest,"%Y-%m-%d %H:%M:%S")