https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/577131#M101941 <P>came here for same question</P><P>&nbsp;</P> Thu, 02 Dec 2021 19:59:49 GMT lbruhns 2021-12-02T19:59:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/482852#M82725 <P>Hi Splunker,</P> <P>How can i Write the splunk query to show the state of a port for local address? The result of netstat is for the whole ports on the particular server, and the results be like:</P> <P>Proto Recv-Q Send-Q LocalAddress ForeignAddress State<BR /> tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN</P> <P>Now in this case, how shall i write the query if the State for port 111 changes from Listen to CLOSED_WAIT or Closed etc...?</P> Wed, 13 Nov 2019 11:20:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/482852#M82725 sarvesh_11 2019-11-13T11:20:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/577131#M101941 <P>came here for same question</P><P>&nbsp;</P> Thu, 02 Dec 2021 19:59:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/577131#M101941 lbruhns 2021-12-02T19:59:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/577208#M101955 <P>Put that in a table for all the fields and search for State!= Listen</P> Fri, 03 Dec 2021 12:40:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/577208#M101955 SinghK 2021-12-03T12:40:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/577209#M101956 <P>| table .....| search state!=Listen</P> Fri, 03 Dec 2021 12:41:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-raise-the-alert-for-sourcetype-netstat/m-p/577209#M101956 SinghK 2021-12-03T12:41:32Z