- Splunk Answers
- :
- Splunk Premium Solutions
- :
- Security Premium Solutions
- :
- Splunk Enterprise Security
- :
- Re: As per default search it will looking for all ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As per default search it will looking for all the ports but I wants to look for only specific port range of 1 to 1024.
| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count" from datamodel=Application_State.All_Application_State where nodename=All_Application_State.Ports by "All_Application_State.dest" | rename "All_Application_State.dest" as "dest" | where 'port_count'>20
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey @javiergn,
Can you try using this query:
| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count"
from
datamodel=Application_State.All_Application_State
where
nodename=All_Application_State.Ports AND
All_Application_State.Ports.transport_dest_port < "1025"
by
"All_Application_State.dest"
| rename "All_Application_State.dest" as "dest"
| where 'port_count'>20
Let me know if this helps!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry for late replay. But also no luck with your modifications. @deepashri_123
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is the datamodel accelerated?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@deepashri_123
Yes. datamodel is accelerated. I am able to run by default search but not able to run with your modification. The result is empty. It does not show any error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Maybe something like this (NOT TESTED as I don't have Enterprise Security installed):
| tstats summariesonly=true allow_old_summaries=true dc(All_Application_State.Ports.transport_dest_port) as "port_count"
from
datamodel=Application_State.All_Application_State
where
nodename=All_Application_State.Ports
All_Application_State.Ports.transport_dest_port >= 1
All_Application_State.Ports.transport_dest_port <= 1024
by
"All_Application_State.dest"
| rename "All_Application_State.dest" as "dest"
| where 'port_count'>20
It is pretty much your search with 2 filters in the where clause in order to look for ports 1-1024, assuming that field is a number of course.
Hope that helps,
J
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @javiergn
But it's not working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, what kind of error do you get? or is it just empty?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry to late replay. @javiergn
It's empty.
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
