Getting Data In

How can I filter a field using a lookup csv file?

tomscott21
Engager

I have a csv file called ports.csv, this contains one column called "port", this contains all of the port numbers 0-1024. I want to use this csv to filter the dest_port field in my Splunk search.

So essentially I want to only see events that have which have the destination port 0-1024, how can I do this?. Is there an easier way to do this without a CSV lookupfile? o

Tags (2)
0 Karma

woodcock
Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND NOT [ |inputlookup MyPortLookupFileHere.csv | table MyPortFieldNameHere | rename MyPortFieldNameHere AS dest_port ]

But why not just do as @richgalloway suggested like this?

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND dest_port<=1024
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried putting dest_port <= 1024 in your base search?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...