Splunk Dev

Port number in event field

rs2OOO
New Member

Sorry for a beginners question, but I have been thrown in the deep end with this.

I have an error.log file, in the event part for each entry it shows [time] [error] [pid number] [IP address:Port number] and then some text.

Does the Port number refer to the IP address shown or to the server creating the error log?

Thanks.

Tags (1)
0 Karma

rs2OOO
New Member

Thanks, that's what I expected but had hoped it was showing the internal port number.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a 99.9999% chance the port number refers to the IP address.

---
If this reply helps you, Karma would be appreciated.

woodcock
Esteemed Legend

I'd say 100%. That is standard network convention.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...