Searching for a particular value in the field


I have a network flow data which contain destination ip address, source ip address and tcp_flag fileds. Tcp_flag field contains different values like
"tcp_flag":[ACK, SYN, RST]

I want to configure a job which looks for source ip address that are sending only "SYN" to the destination ip address.
So can I know what are the functions and field name (over_field, by_field, partition_field) that has to configured in the detector.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.