Filtering logs based on number of entries (source and destination)

[ahmed_aburaihan]

Hallo dear Seniors and Juniors 

I am using Smartview to get Logs for a specific time period (for example from Date to Date). 

I want that if the LOGS are generated for the same Source and Destination more than one time, it should not be shown. 

Is there any nice query which could do that? 

Thank you. 

AAA.

[PhoneBoy · Accepted solution]

For future logs...you can ensure the relevant rules logs by Session (instead of by Connection).
Even with that, I suspect you won't be able to suppress all the logs.

[the_rock]

Hey Ahmed,

What @PhoneBoy said is exactly the way to do it. I worked with a client few years back who inquired about the same and TAC actually gave them this answer. Not sure if there is alternate method of doing this, but this is what Im also aware of.

Best,

Andy

[emmap]

Anything beyond that would involve exporting the logs to CSV and using external tools to do your filtering/compressing.

[ahmed_aburaihan]

Hi @emmap 

I actually did the same (ms excel), thank you for the comment.