Splunk Search

how to filter out only specific output

Loves-to-Learn Lots

Hi All, Could you please help me.

scenario :- i want a result where one field contains a specific value, but in result I am getting all the value along with my specific value.

example- index=xx port="10" Or port="110" | 

output is like :- hostname port 23 25 110 80 443


i want to show only port 10 or 110 only, not all the ports are open for the host.


Note: "AND" will not work as it will only search those host which are having only 10 or 110 ports open, 

Labels (3)
0 Karma

Esteemed Legend

Hi @saurav47,

please try something like this:

index=xx (port=10 OR port=110)
| ...

In few words:

  • use parenthesis,
  • OR in uppercase.



0 Karma



Depending of your data you probably can try 

index=xx TERM(port=10) OR TERM(port=110)

Anyhow @gcusello 's answer should works also.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...