topic Using Splunk to count within a search - users to ip addresses in Splunk Search

Using Splunk to count within a search - users to ip addresses

bnolen — Thu, 17 Jun 2010 09:40:08 GMT

Hi all,

I have logs in the following format

2010-06-17 02:04:55 user1 ip.add.ress.here GET /mysite/mypage.html
2010-06-17 02:04:59 user1 ip.add.ress.here POST /mysite/mypage2.html
2010-06-17 02:05:23 user2 ip.add.ress.here GET /mysite/mypage.html

What my question is, is there an easy way to search for all users that have logged in from multiple ip addresses, and also for all ip addresses that have been used by multiple users.

Re: Using Splunk to count within a search - users to ip addresses

gkanapathy — Thu, 17 Jun 2010 10:21:23 GMT

... | stats distinct_count(ipaddress) as dcip by user | where dcip > 1

and

... | stats distinct_count(user) as dcu by ipaddress | where dcu > 1

respectively will do it.