topic Search data by result count in Splunk Search

Search data by result count

balcv — Mon, 18 Dec 2023 04:10:16 GMT

I have a search that returns a list of users and the country logins have occurred from grouped by user.

index=o365 UserloginFailed* | iplocation ClientIP | search Country!=Australia | stats values(Country) by user

So if a user logins from one Country, then a get a single record for the user (user, Country).
If a user logins in from multiple locations, I get the user name in one column and a list of the source locations in the values(County) column.

I would like to construct the search so that only see those users who have logins from multiple Countries.
Thanks

Re: Search data by result count

dtburrows3 — Mon, 18 Dec 2023 04:30:39 GMT

I think this SPL will do what you are looking for.

index=o365 UserloginFailed* | iplocation ClientIP | search Country!=Australia | stats values(Country) as Country by user | where mvcount(Country)>1

Re: Search data by result count

balcv — Mon, 18 Dec 2023 04:42:44 GMT

Perfect. Thank you @dtburrows3