how to filter out only specific output

[saurav47]

Hi All, Could you please help me.

scenario :- i want a result where one field contains a specific value, but in result I am getting all the value along with my specific value.

example- index=xx port="10" Or port="110" | 

output is like :- hostname port 23 25 110 80 443

i want to show only port 10 or 110 only, not all the ports are open for the host.

Note: "AND" will not work as it will only search those host which are having only 10 or 110 ports open, 

[gcusello]

Hi @saurav47,

please try something like this:

index=xx (port=10 OR port=110)
| ...

In few words:

• use parenthesis,
• OR in uppercase.

Ciao.

Giuseppe

[isoutamo]

Hi

Depending of your data you probably can try 

index=xx TERM(port=10) OR TERM(port=110)

Anyhow @gcusello 's answer should works also.

r. Ismo