https://community.splunk.com/t5/Splunk-Search/How-to-show-an-IP-is-associated-with-multiple-usernames/m-p/501785#M139681 <P>That worked great. Thanks </P> Tue, 15 Oct 2019 15:11:57 GMT alexrod03 2019-10-15T15:11:57Z https://community.splunk.com/t5/Splunk-Search/How-to-show-an-IP-is-associated-with-multiple-usernames/m-p/501783#M139679 <P>I have one source type and 2 field values, username and IP. <BR /> How do I show IP that is associated with multiple usernames. </P> Mon, 14 Oct 2019 19:52:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-an-IP-is-associated-with-multiple-usernames/m-p/501783#M139679 alexrod03 2019-10-14T19:52:36Z https://community.splunk.com/t5/Splunk-Search/How-to-show-an-IP-is-associated-with-multiple-usernames/m-p/501784#M139680 <P>@alexrod03,<BR /> Try</P> <PRE><CODE>your search |stats dc(username) as count,values(username) as usernames by IP | where count &gt; 1 </CODE></PRE> Tue, 15 Oct 2019 13:28:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-an-IP-is-associated-with-multiple-usernames/m-p/501784#M139680 renjith_nair 2019-10-15T13:28:20Z https://community.splunk.com/t5/Splunk-Search/How-to-show-an-IP-is-associated-with-multiple-usernames/m-p/501785#M139681 <P>That worked great. Thanks </P> Tue, 15 Oct 2019 15:11:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-an-IP-is-associated-with-multiple-usernames/m-p/501785#M139681 alexrod03 2019-10-15T15:11:57Z