https://community.splunk.com/t5/Getting-Data-In/Splunk-whitelisting-ports-as-csv/m-p/354341#M64801 <P>sourcetype=syslog dst_port=*| lookup ports.csv port as dst_port OUTPUTNEW port as isWhitelist | where isnull(isWhitelist) </P> Tue, 29 Sep 2020 13:17:28 GMT starcher 2020-09-29T13:17:28Z https://community.splunk.com/t5/Getting-Data-In/Splunk-whitelisting-ports-as-csv/m-p/354340#M64800 <P>Hey!</P> <P>I'm trying to make a search that takes all values from my whitelist and compares them to all destination ports. The goal of this search is to see, if a port that is not whitelisted is used. To accomplish this i want to evaluate the distinct count of all destination ports and compare this value to the distinct count of the destination ports that match the whitelist.</P> <P>My search is as follows:</P> <P>| inputlookup ports.csv | eval port=Ports | append [search sourcetype=syslog dst_port!="" | eval destination=dst_port]|stats distinct_count(destination) as unique_ports| stats distinct_count(destination) as matches|where destintation = port|table unique_ports, matches</P> <P>When i try to run the search no data is found...</P> <P>Thanks.</P> Tue, 29 Sep 2020 13:13:35 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-whitelisting-ports-as-csv/m-p/354340#M64800 soesia12 2020-09-29T13:13:35Z https://community.splunk.com/t5/Getting-Data-In/Splunk-whitelisting-ports-as-csv/m-p/354341#M64801 <P>sourcetype=syslog dst_port=*| lookup ports.csv port as dst_port OUTPUTNEW port as isWhitelist | where isnull(isWhitelist) </P> Tue, 29 Sep 2020 13:17:28 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-whitelisting-ports-as-csv/m-p/354341#M64801 starcher 2020-09-29T13:17:28Z