Range queries let you search sessions for documents that match field values between the lower and upper bounds specified by the range query. This is useful when searching for port ranges, date and timestamp ranges, flow sizes, and flag values. Range queries can be inclusive or exclusive of the upper and lower bounds. Sorting is done lexicographically.
For example, search documents whose sourceTransportPort field have values between 0 and 80, inclusive. Range queries are not reserved for integer or date fields. To run this range query, enter the query syntax below using the steps defined in the Entering Queries section:
You can also use range queries with string fields. The search below finds all documents whose httpHosts are between abc.com and stackflow.org, but not including abc.com and stackflow.org.
Note
Inclusive range queries are denoted by [ ] square brackets.
Exclusive range queries are denoted by { } curly brackets.