I have a csv file called ports.csv, this contains one column called "port", this contains all of the port numbers 0-1024. I want to use this csv to filter the dest_port field in my Splunk search.
So essentially I want to only see events that have which have the destination port 0-1024, how can I do this?. Is there an easier way to do this without a CSV lookupfile? o
index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND NOT [ |inputlookup MyPortLookupFileHere.csv | table MyPortFieldNameHere | rename MyPortFieldNameHere AS dest_port ]
But why not just do as @richgalloway suggested like this?
index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND dest_port<=1024
Have you tried putting dest_port <= 1024 in your base search?
dest_port <= 1024