Splunk Search

Searching a port range

EricPartington
Communicator

How can i search for matches using a port range on an extracted field?

for example:

if i want all events in port range 512-514 and i have a field extracted as dest_ip

or a larger extension, how to search using ranges of values?

Tags (2)
1 Solution

ziegfried
Influencer

You can search for ranges like this:

sourcetype=mysourcetype myfield>=512 myfield<=514

Which will give you results for events with myfield values from 512 to 514.

View solution in original post

ziegfried
Influencer

You can search for ranges like this:

sourcetype=mysourcetype myfield>=512 myfield<=514

Which will give you results for events with myfield values from 512 to 514.

merrymana
Engager

Could you provide an example?

0 Karma

merrymana
Engager

I discovered another method to search for a range:
src_ip IN (10.10., 10.20., 10.30.)
or
dest_port IN (110, 111, 112, 113)
instead of
src_ip=10.10.
OR src_ip=10.20.* OR src_ip=10.30.*
or
dest_port=110 OR dest_port=111 OR dest_port=112

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...