Removing ports utilizing "between" X and Y

[Hegemon76]

Hello,

I am trying to use a "between" function. For instance:

index=main sourcetype=":cisco_asa" | where dest_port > 1024 AND dest_port!= 8000-8999 etc etc

Obviously "8000-8999" does not work. Any help would be appreciated.

Thank You,

Tim

[elliotproebstel · Accepted solution]

The way to search for dest_port!=8000-8999 would be to split it like this: dest_port<8000 OR dest_port>8999. Also, you don't need to push that into a where clause; it can (and should) go directly into your base search for better efficiency:

index=main sourcetype=":cisco_asa" dest_port > 1024 AND (dest_port<8000 OR dest_port>8999)

[Hegemon76]

Perfect!

Thanks!

[ppablo]

Hi @Hegemon76

Glad you found your answer through the awesome @elliotproebstel 🙂 Please don't forget to resolve your question by clicking "Accept" directly below his answer. This will make the solution easier to find for others who have the same question. Also, upvoting posts by the users who help you out is always encouraged.

Thanks!

[Hegemon76]

Done and Done

[ppablo]

Thank you!