Splunk Search

Searching a port range

EricPartington
Communicator

How can i search for matches using a port range on an extracted field?

for example:

if i want all events in port range 512-514 and i have a field extracted as dest_ip

or a larger extension, how to search using ranges of values?

Tags (2)
1 Solution

ziegfried
Influencer

You can search for ranges like this:

sourcetype=mysourcetype myfield>=512 myfield<=514

Which will give you results for events with myfield values from 512 to 514.

View solution in original post

ziegfried
Influencer

You can search for ranges like this:

sourcetype=mysourcetype myfield>=512 myfield<=514

Which will give you results for events with myfield values from 512 to 514.

merrymana
Engager

Could you provide an example?

0 Karma

merrymana
Engager

I discovered another method to search for a range:
src_ip IN (10.10., 10.20., 10.30.)
or
dest_port IN (110, 111, 112, 113)
instead of
src_ip=10.10.
OR src_ip=10.20.* OR src_ip=10.30.*
or
dest_port=110 OR dest_port=111 OR dest_port=112

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...