I am trying to get the number of denied connections from squid proxy logs from a Cisco Ironport web security appliance.
Using sc_result_code with values:
TCP_DENIED,
TCP_MISS,
TCP_CLIENT_REFRESH_MISS,
TCP_MEM_HIT,
TCP_REFRESH_HIT,
TCP_IMS_HIT,
TCP_HIT
I would like to get a table that shows the tcp_denied value as count and a count% and the other values combined with a count and a count %.
... | eval sc_type = if(sc_result_code == "TCP_DENIED", "TCP_DENIED", "OTHER") | top sc_type