Getting Data In
Highlighted

How can I filter a field using a lookup csv file?

Engager

I have a csv file called ports.csv, this contains one column called "port", this contains all of the port numbers 0-1024. I want to use this csv to filter the dest_port field in my Splunk search.

So essentially I want to only see events that have which have the destination port 0-1024, how can I do this?. Is there an easier way to do this without a CSV lookupfile? o

Tags (2)
0 Karma
Highlighted

Re: How can I filter a field using a lookup csv file?

SplunkTrust
SplunkTrust

Have you tried putting dest_port <= 1024 in your base search?

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: How can I filter a field using a lookup csv file?

Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND NOT [ |inputlookup MyPortLookupFileHere.csv | table MyPortFieldNameHere | rename MyPortFieldNameHere AS dest_port ]

But why not just do as @richgalloway suggested like this?

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND dest_port<=1024
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.