Range notation

Prev Next

Non-inclusive ranges can be specified by enclosing the start and end values of the range in angle brackets ( < > ), separated by commas. This functions as a shorthand for two separate filters using the greater than ( > ) and less than ( < ) operators joined by an and Boolean operator. For example, the following query:

     srcport > 8999 and srcport < 9301

can be rewritten as:

     srcport:<8999,9301>

using range notation. When using range notation, you must use the match ( : ) operator.