index=_internal tcpouteloop "connected to idx" | stats count by idx
0 comments
[0]
[0]
[0]
[0]
| datamodel Network_Traffic All_Traffic search | dedup All_Traffic.dest | stats count by All_Traffic.src_ip, All_Traffic.dest,All_Traffic.action
0 comments
[1]
[0]
[1]
[0]