Splunk Search

how to filter out only specific output

saurav47
Loves-to-Learn Lots

Hi All, Could you please help me.

scenario :- i want a result where one field contains a specific value, but in result I am getting all the value along with my specific value.

example- index=xx port="10" Or port="110" | 

output is like :- hostname port 23 25 110 80 443

 

i want to show only port 10 or 110 only, not all the ports are open for the host.

 

Note: "AND" will not work as it will only search those host which are having only 10 or 110 ports open, 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @saurav47,

please try something like this:

index=xx (port=10 OR port=110)
| ...

In few words:

  • use parenthesis,
  • OR in uppercase.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Depending of your data you probably can try 

index=xx TERM(port=10) OR TERM(port=110)

Anyhow @gcusello 's answer should works also.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...