https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56194#M10973 <P>Final search looked something like this:</P> <P>sourcetype="x" NOT src="0.0.0.0" (host="a" OR host="b" OR host="c" OR host="d")| stats dc(host) as dc by src | where dc&gt;1 | sort - dc | lookup geoip clientip as src | fields - client_lat,client_lon,client_region,client_city | rename dc as "Clients Attacked" | rename client_country as Country</P> Mon, 28 Sep 2020 13:29:02 GMT Adrian 2020-09-28T13:29:02Z https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56191#M10970 <P>Require assistance to formulate a search which identifies the same source IP(src) across one or more hosts (opposite of unique value such as distinct count) with the same sourcetype</P> <P>Need to answer this question: What source IP do these host(s) have in common?</P> <P>sourcetype=x</P> <P>host=a</P> <P>host=b</P> <P>host=c</P> <P>host=d</P> Fri, 08 Mar 2013 20:50:06 GMT https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56191#M10970 Adrian 2013-03-08T20:50:06Z https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56192#M10971 <P>I'm assuming you want to find IPs that occur in all four hosts.</P> <PRE><CODE>sourcetype=x (host=a OR host=b OR host=c OR host=d) | stats dc(host) as dc by src | where dc==4 </CODE></PRE> Fri, 08 Mar 2013 20:58:03 GMT https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56192#M10971 martin_mueller 2013-03-08T20:58:03Z https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56193#M10972 <P>Thanks Martin. That pretty much gets me where I need to be.</P> Fri, 08 Mar 2013 21:18:34 GMT https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56193#M10972 Adrian 2013-03-08T21:18:34Z https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56194#M10973 <P>Final search looked something like this:</P> <P>sourcetype="x" NOT src="0.0.0.0" (host="a" OR host="b" OR host="c" OR host="d")| stats dc(host) as dc by src | where dc&gt;1 | sort - dc | lookup geoip clientip as src | fields - client_lat,client_lon,client_region,client_city | rename dc as "Clients Attacked" | rename client_country as Country</P> Mon, 28 Sep 2020 13:29:02 GMT https://community.splunk.com/t5/Getting-Data-In/Find-the-common-same-source-ip-src-across-several-hosts-with/m-p/56194#M10973 Adrian 2020-09-28T13:29:02Z