topic Re: Port number in event field in Splunk Dev

Port number in event field

rs2OOO — Wed, 09 May 2018 19:29:41 GMT

Sorry for a beginners question, but I have been thrown in the deep end with this.

I have an error.log file, in the event part for each entry it shows [time] [error] [pid number] [IP address:Port number] and then some text.

Does the Port number refer to the IP address shown or to the server creating the error log?

Thanks.

richgalloway — Wed, 09 May 2018 19:49:07 GMT

There's a 99.9999% chance the port number refers to the IP address.

woodcock — Thu, 10 May 2018 04:33:03 GMT

I'd say 100%. That is standard network convention.

rs2OOO — Thu, 10 May 2018 07:15:28 GMT

Thanks, that's what I expected but had hoped it was showing the internal port number.