topic Re: How can I filter a field using a lookup csv file? in Getting Data In

How can I filter a field using a lookup csv file?

tomscott21 — Wed, 18 Mar 2020 12:11:39 GMT

I have a csv file called ports.csv, this contains one column called "port", this contains all of the port numbers 0-1024. I want to use this csv to filter the dest_port field in my Splunk search.

So essentially I want to only see events that have which have the destination port 0-1024, how can I do this?. Is there an easier way to do this without a CSV lookupfile? o

Re: How can I filter a field using a lookup csv file?

richgalloway — Wed, 18 Mar 2020 12:43:12 GMT

Have you tried putting dest_port <= 1024 in your base search?

Re: How can I filter a field using a lookup csv file?

woodcock — Wed, 18 Mar 2020 14:40:52 GMT

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND NOT [ |inputlookup MyPortLookupFileHere.csv | table MyPortFieldNameHere | rename MyPortFieldNameHere AS dest_port ]

But why not just do as @richgalloway suggested like this?

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND dest_port<=1024