Show only unique IPs in Smart Console log viewer

[Trevor]

Hi all!

Is there a way to filter log entries in Smart Console for unique IPs? 

For example: I needed to provide a list of improperly configured workstation clients.  We recently had a desktop tech configure an old DNS server on some devices. This IP is getting blocked by the gateway, as it's no longer in production.  My search query is "src:10.10.10.0/24 port:53" Of course, this will show every hit.  I've been adding each IP to a "NOT" in the query to whittle down the list, but this is really inefficient ... especially on a /23!

Is there a way to only display unique source IPs in Smart Console log viewer?

We're on R81.20 and are in an enterprise environment with dedicated MDS/CP mgmt and log servers.

Or if there is a better way to pull this info, I'd gladly do it by a different method... maybe reports?

Thanks in advance!

[Lesley]

Why not like this: dst: OLD server port:53

Or make a group, add all old servers into it and use that as filter.

dst:Old-group-server

[Trevor]

But the issue remains:  Every source IP will be in the results for each and every hit. So if 10.10.10.123 is having a busy day, it could have hundreds of log entries trying the old DNS server... making 10.10.10.135, .140, .150, etc hard to find.

My goal is to give the techs a list of unique IPs, so they can remote into them and configure with the correct DNS.

Thanks for the response! 🙂

[Lesley]

User smartview for this: https://<Host Name of Management Server or IP>/smartview/

To export logs:

1. In the Logs tab, click Options and select Export > Export to CSV.

   The CSV Export window opens.

2. Select the Logs Amount.

3. Select the Exported Columns - All columns or Visible columns.

4. Click OK.

5. A popup window appears when the export process starts.

   When you see a message that the exported completed successfully, click Download.

   All exported logs also appear in the archive tab.

Then you have the info in Excel. There you could remove duplicate entries and share list to the admins. 

[Trevor]

That is what I will end up doing... unless someone has a better idea. I know this must be a common need for anyone needing to make a list of "problem" clients... so seems there would be a built-in way to filter things down in Smart Console.