Splunk Enterprise Security

As per default search it will looking for all the ports but I wants to look for only specific port range of 1 to 1024.

N92
Path Finder

| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count" from datamodel=Application_State.All_Application_State where nodename=All_Application_State.Ports by "All_Application_State.dest" | rename "All_Application_State.dest" as "dest" | where 'port_count'>20

0 Karma

deepashri_123
Motivator

Hey @javiergn,

Can you try using this query:

| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count"
from
datamodel=Application_State.All_Application_State
where
nodename=All_Application_State.Ports AND
All_Application_State.Ports.transport_dest_port < "1025"
by
"All_Application_State.dest"
| rename "All_Application_State.dest" as "dest"
| where 'port_count'>20

Let me know if this helps!!

0 Karma

N92
Path Finder

Sorry for late replay. But also no luck with your modifications. @deepashri_123

0 Karma

deepashri_123
Motivator

is the datamodel accelerated?

0 Karma

N92
Path Finder

@deepashri_123
Yes. datamodel is accelerated. I am able to run by default search but not able to run with your modification. The result is empty. It does not show any error.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Maybe something like this (NOT TESTED as I don't have Enterprise Security installed):

| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count" 
from 
    datamodel=Application_State.All_Application_State 
where 
    nodename=All_Application_State.Ports
    All_Application_State.Ports.transport_dest_port >= 1
    All_Application_State.Ports.transport_dest_port <= 1024
by 
    "All_Application_State.dest" 
| rename "All_Application_State.dest" as "dest" 
| where 'port_count'>20

It is pretty much your search with 2 filters in the where clause in order to look for ports 1-1024, assuming that field is a number of course.

Hope that helps,
J

0 Karma

N92
Path Finder

Thanks @javiergn

But it's not working.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, what kind of error do you get? or is it just empty?

0 Karma

N92
Path Finder

sorry to late replay. @javiergn

It's empty.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...