Splunk Search

how to filter out only specific output

saurav47
Loves-to-Learn Lots

Hi All, Could you please help me.

scenario :- i want a result where one field contains a specific value, but in result I am getting all the value along with my specific value.

example- index=xx port="10" Or port="110" | 

output is like :- hostname port 23 25 110 80 443

 

i want to show only port 10 or 110 only, not all the ports are open for the host.

 

Note: "AND" will not work as it will only search those host which are having only 10 or 110 ports open, 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @saurav47,

please try something like this:

index=xx (port=10 OR port=110)
| ...

In few words:

  • use parenthesis,
  • OR in uppercase.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Depending of your data you probably can try 

index=xx TERM(port=10) OR TERM(port=110)

Anyhow @gcusello 's answer should works also.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...