Hello,
I am trying to use a "between" function. For instance:
index=main sourcetype=":cisco_asa" | where dest_port > 1024 AND dest_port!= 8000-8999 etc etc
Obviously "8000-8999" does not work. Any help would be appreciated.
Thank You,
Tim
The way to search for dest_port!=8000-8999 would be to split it like this: dest_port<8000 OR dest_port>8999
. Also, you don't need to push that into a where
clause; it can (and should) go directly into your base search for better efficiency:
index=main sourcetype=":cisco_asa" dest_port > 1024 AND (dest_port<8000 OR dest_port>8999)
The way to search for dest_port!=8000-8999 would be to split it like this: dest_port<8000 OR dest_port>8999
. Also, you don't need to push that into a where
clause; it can (and should) go directly into your base search for better efficiency:
index=main sourcetype=":cisco_asa" dest_port > 1024 AND (dest_port<8000 OR dest_port>8999)
Perfect!
Thanks!
Hi @Hegemon76
Glad you found your answer through the awesome @elliotproebstel 🙂 Please don't forget to resolve your question by clicking "Accept" directly below his answer. This will make the solution easier to find for others who have the same question. Also, upvoting posts by the users who help you out is always encouraged.
Thanks!
Done and Done
Thank you!