How to create a search to get it to display results when count of IP Address is exactly 2?

aikn061 — Fri, 10 Jun 2022 04:51:43 GMT

Hi Guys,

I already have a query below that gives me a table similar to the one on bottom. I was wondering if there is a way to get it to display results when count of IP Address is exactly 2?

Meaning show results when IP address = 2 otherwise dont show it. So 3rd entry should not show but first two should.

Please let me know if any ideas. Appreciate your helps in advance.

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where count > 20

Account_Name	EventID	Message	Count	IP Address
SmithA	4771	Kerberos pre-authentication failed	5000	1.1.1.1 2.2.2.2
JohnsonX	4771	Kerberos pre-authentication failed	6000	3.3.3.3 4.4.4.4
washingtonZ	4771	Kerberos pre-authentication failed	7000	5.5.5.5

Re: When count = 1

richgalloway — Fri, 10 Jun 2022 00:32:36 GMT

Use the mvcount function to find the number of IP addresses.

index=EventLog source=security EventCode=4771 | stats count values(source) AS IP_Address BY Account_Name EventID Message | where (count > 20 AND mvcount(IP_Address)=2)

Re: When count = 1

aikn061 — Fri, 10 Jun 2022 00:40:26 GMT

Thank you! Worked like a charm.

topic How to create a search to get it to display results when count of IP Address is exactly 2? in Splunk Search

How to create a search to get it to display results when count of IP Address is exactly 2?

Re: When count = 1

Re: When count = 1