Deployment Architecture

Is it possible to group by tcp ports with "TCP_High_Port" or "UDP_High_Port" instead?

johnsonchuanglf
New Member

I have list of output here from command. With stats command it comes with long list of service (tcp or udp high ports), is there any command to group by them with condition if port number greater than 1024? It would be grateful if you guys can help. Thanks!

index=someindex |stats count by dstip service|sort count|stats values(service) list(count) by dstip

OUTPUT
services dstip
t
cp_1028 192.168.1.10
tcp_1029
tcp_1030
tcp/10100
tcp/10108
tcp_2056 192.168.1.20
tcp_2068
udp_3378
udp_4069

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@johnsonchuanglf,

Try

"your base search"
|rex field=services "(?<protocol>\w{3})[_\/](?<port>\d+)"
|stats count(eval(port>1024)) as count,values(services) as services by protocol,dstip 

You may remove values(services) if you do not want the list with the count

Happy Splunking!
0 Karma

johnsonchuanglf
New Member

Thanks for your help. Shall I have the result with TCP_High_Port return instead of "list of service values"?

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...