https://community.splunk.com/t5/Splunk-Search/searching-for-multiple-destination-ports/m-p/505550#M141283 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/208972">@allenhau</a>&nbsp;</P><P>Use either one of the below in your base search</P><P>OR command</P><P><SPAN>dest_port=4402 OR&nbsp;dest_port=4404</SPAN></P><P>IN command</P><P>dest_port IN (""4402 4404"")</P><P>&nbsp;</P> Mon, 22 Jun 2020 17:05:54 GMT anilchaithu 2020-06-22T17:05:54Z https://community.splunk.com/t5/Splunk-Search/searching-for-multiple-destination-ports/m-p/505547#M141282 <P>I have a search query for:</P><P>dest_port=4402</P><P>&nbsp;</P><P>I want to include 4404.&nbsp; what would the syntax for dest_port look like?</P> Mon, 22 Jun 2020 16:59:08 GMT https://community.splunk.com/t5/Splunk-Search/searching-for-multiple-destination-ports/m-p/505547#M141282 allenhau 2020-06-22T16:59:08Z https://community.splunk.com/t5/Splunk-Search/searching-for-multiple-destination-ports/m-p/505550#M141283 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/208972">@allenhau</a>&nbsp;</P><P>Use either one of the below in your base search</P><P>OR command</P><P><SPAN>dest_port=4402 OR&nbsp;dest_port=4404</SPAN></P><P>IN command</P><P>dest_port IN (""4402 4404"")</P><P>&nbsp;</P> Mon, 22 Jun 2020 17:05:54 GMT https://community.splunk.com/t5/Splunk-Search/searching-for-multiple-destination-ports/m-p/505550#M141283 anilchaithu 2020-06-22T17:05:54Z https://community.splunk.com/t5/Splunk-Search/searching-for-multiple-destination-ports/m-p/521184#M146838 <P>Works. But how do you clean it up where it returns just a single line to show both ports. It's currently showing multiple lines for each different port.</P> Thu, 24 Sep 2020 03:06:17 GMT https://community.splunk.com/t5/Splunk-Search/searching-for-multiple-destination-ports/m-p/521184#M146838 eddy_liang 2020-09-24T03:06:17Z