Splunk Enterprise Security

As per default search it will looking for all the ports but I wants to look for only specific port range of 1 to 1024.

Path Finder

| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count" from datamodel=Application_State.All_Application_State where nodename=All_Application_State.Ports by "All_Application_State.dest" | rename "All_Application_State.dest" as "dest" | where 'port_count'>20

0 Karma

Motivator

Hey @javiergn,

Can you try using this query:

| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count"
from
datamodel=Application_State.All_Application_State
where
nodename=All_Application_State.Ports AND
All_Application_State.Ports.transport_dest_port < "1025"
by
"All_Application_State.dest"
| rename "All_Application_State.dest" as "dest"
| where 'port_count'>20

Let me know if this helps!!

0 Karma

Path Finder

Sorry for late replay. But also no luck with your modifications. @deepashri_123

0 Karma

Motivator

is the datamodel accelerated?

0 Karma

Path Finder

@deepashri_123
Yes. datamodel is accelerated. I am able to run by default search but not able to run with your modification. The result is empty. It does not show any error.

0 Karma

SplunkTrust
SplunkTrust

Maybe something like this (NOT TESTED as I don't have Enterprise Security installed):

| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count" 
from 
    datamodel=Application_State.All_Application_State 
where 
    nodename=All_Application_State.Ports
    All_Application_State.Ports.transport_dest_port >= 1
    All_Application_State.Ports.transport_dest_port <= 1024
by 
    "All_Application_State.dest" 
| rename "All_Application_State.dest" as "dest" 
| where 'port_count'>20

It is pretty much your search with 2 filters in the where clause in order to look for ports 1-1024, assuming that field is a number of course.

Hope that helps,
J

0 Karma

Path Finder

Thanks @javiergn

But it's not working.

0 Karma

SplunkTrust
SplunkTrust

Hi, what kind of error do you get? or is it just empty?

0 Karma

Path Finder

sorry to late replay. @javiergn

It's empty.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!