How can I filter a field using a lookup csv file?

[tomscott21]

I have a csv file called ports.csv, this contains one column called "port", this contains all of the port numbers 0-1024. I want to use this csv to filter the dest_port field in my Splunk search.

So essentially I want to only see events that have which have the destination port 0-1024, how can I do this?. Is there an easier way to do this without a CSV lookupfile? o

[woodcock]

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND NOT [ |inputlookup MyPortLookupFileHere.csv | table MyPortFieldNameHere | rename MyPortFieldNameHere AS dest_port ]

But why not just do as @richgalloway suggested like this?

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND dest_port<=1024

[richgalloway]

Have you tried putting dest_port <= 1024 in your base search?