https://community.splunk.com/t5/Security/how-can-i-filter-abnormal-login-from-same-user-different-IP/m-p/418418#M12978 <P>@lllidan,</P> <P>can you share more information about events or provide sample event?</P> Wed, 22 Aug 2018 09:57:25 GMT kamlesh_vaghela 2018-08-22T09:57:25Z https://community.splunk.com/t5/Security/how-can-i-filter-abnormal-login-from-same-user-different-IP/m-p/418417#M12977 <P>I have to say I'm a layman on Splunk. but i got a requirement from my boss , i need to search the same user login via different IP addresses during five minutes.<BR /> i admire the man who can help me .</P> Wed, 22 Aug 2018 09:32:14 GMT https://community.splunk.com/t5/Security/how-can-i-filter-abnormal-login-from-same-user-different-IP/m-p/418417#M12977 lllidan 2018-08-22T09:32:14Z https://community.splunk.com/t5/Security/how-can-i-filter-abnormal-login-from-same-user-different-IP/m-p/418418#M12978 <P>@lllidan,</P> <P>can you share more information about events or provide sample event?</P> Wed, 22 Aug 2018 09:57:25 GMT https://community.splunk.com/t5/Security/how-can-i-filter-abnormal-login-from-same-user-different-IP/m-p/418418#M12978 kamlesh_vaghela 2018-08-22T09:57:25Z https://community.splunk.com/t5/Security/how-can-i-filter-abnormal-login-from-same-user-different-IP/m-p/418419#M12979 <P>Your base search will be specific to your environment (i.e. Windows Event codes, ssh login messages, etc), but if you get your base search, you can than do something like:<BR /> "yoursearch" | chart count over user by host<BR /> Again, it will depend on your source data. If you give a bit more info (sourcetypes, etc), be happy to respond.</P> Thu, 23 Aug 2018 15:10:38 GMT https://community.splunk.com/t5/Security/how-can-i-filter-abnormal-login-from-same-user-different-IP/m-p/418419#M12979 sshelly_splunk 2018-08-23T15:10:38Z