Thanks for increasing my knowledge on this, sincerely appreciated.   ... View more

Thanks for replying Rick, Running the following: index=Network dest_ip=xx.xx.xx.xx. action=allowed | bin span=1d | stats count by src_ip _time Returns the following error: Error in 'bin' command: You must specify a field to discretize. Not looking to list the source IP's, just need counts per day so have tried using: index=Network dest_ip=xx.xx.xx.xx. action=allowed | bin _time span=1d | stats count by _time Reading this as  when the condition (index=Network dest_ip=xx.xx.xx.xx. action=allowed) has been met, break up time into 1 day Bins (bin _time span=1d ) and list total count of each time this condition is met for each Bin which is one day. Am I on the right track here?  ... View more

efforts so far include; mysearch| timechart span=1d count by src_ip limit=0 Which displays a grid of IP's against days. Right now, just total connections per day are needed. Peaks during the day itself would be nice. Trying a few suggestions on similar questions posted but none produce the desired results ... View more

Appreciate the assistance from the experts here. The ask has developed. I'm looking to list total connections to destination IP by day, regardless of source to try and determine the volume of connections per day of the week and also if possible to determine when during the day do the number of connections peak. Any help would be greatly appreciated. Thanks in advance ... View more

Thanks for your response; Yes we do have several different network devices, all except firewall traffic goes to a network traffic index with FW events going to a separate index,  but I believe CIM compliance has been taken care of.  ... View more

Thanks for the response Sanjay. index=firewall_us dest_ip=xx.xx.xx.xx action=allowed  | stats list(src_ip) as source count by dest_ip | where count > 1 | sort – count  This doesn't return any results at all Actually I'm just looking for the total number of connections to the destination IP regardless of source IP. ... View more