topic Re: How to filter my search that finds VPN User Session Count by Country to only show users with sessions in multiple countries? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-filter-my-search-that-finds-VPN-User-Session-Count-by/m-p/261581#M78513 <P>Try adding this to the end <CODE>... | where mvcount(Country)&gt;1</CODE></P> Mon, 23 May 2016 19:29:29 GMT sundareshr 2016-05-23T19:29:29Z How to filter my search that finds VPN User Session Count by Country to only show users with sessions in multiple countries? https://community.splunk.com/t5/Splunk-Search/How-to-filter-my-search-that-finds-VPN-User-Session-Count-by/m-p/261580#M78512 <P>I have this search which shows the user sessions count by Country for the date range specified. I am trying to filter only on those users that have sessions in multiple countries. Any suggestions?</P> <PRE><CODE>index=firewall vpn "Session disconnected" | iplocation IP | fields user, Country | stats count as EvtCounts by user, Country | sort -EvtCounts | eval EvtCatCnt = Country." (".EvtCounts.")" | stats sum(EvtCounts) as Total_Events, values(EvtCatCnt) as Country by user | sort -Total_Events | eval User_Count = user." (".Total_Events.")" | table user, Country </CODE></PRE> <P>Current results look like this:</P> <PRE><CODE>user Country bob United States (1) jane United States (2) tarzan Mexico (14) United States (1) </CODE></PRE> <P>Only want to return results like tarzan.</P> Mon, 23 May 2016 19:21:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-my-search-that-finds-VPN-User-Session-Count-by/m-p/261580#M78512 pdumblet 2016-05-23T19:21:18Z Re: How to filter my search that finds VPN User Session Count by Country to only show users with sessions in multiple countries? https://community.splunk.com/t5/Splunk-Search/How-to-filter-my-search-that-finds-VPN-User-Session-Count-by/m-p/261581#M78513 <P>Try adding this to the end <CODE>... | where mvcount(Country)&gt;1</CODE></P> Mon, 23 May 2016 19:29:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-my-search-that-finds-VPN-User-Session-Count-by/m-p/261581#M78513 sundareshr 2016-05-23T19:29:29Z Re: How to filter my search that finds VPN User Session Count by Country to only show users with sessions in multiple countries? https://community.splunk.com/t5/Splunk-Search/How-to-filter-my-search-that-finds-VPN-User-Session-Count-by/m-p/261582#M78514 <P>How about the date they logged in from one country to the other?</P> Mon, 03 Feb 2020 09:26:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-my-search-that-finds-VPN-User-Session-Count-by/m-p/261582#M78514 pjohnson1 2020-02-03T09:26:42Z