Find the common/same source ip (src) across several hosts with same sourcetype

[Adrian]

Require assistance to formulate a search which identifies the same source IP(src) across one or more hosts (opposite of unique value such as distinct count) with the same sourcetype

Need to answer this question: What source IP do these host(s) have in common?

sourcetype=x

host=a

host=b

host=c

host=d

[martin_mueller · Accepted solution]

I'm assuming you want to find IPs that occur in all four hosts.

sourcetype=x (host=a OR host=b OR host=c OR host=d) | stats dc(host) as dc by src | where dc==4

[Adrian]

Final search looked something like this:

sourcetype="x" NOT src="0.0.0.0" (host="a" OR host="b" OR host="c" OR host="d")| stats dc(host) as dc by src | where dc>1 | sort - dc | lookup geoip clientip as src | fields - client_lat,client_lon,client_region,client_city | rename dc as "Clients Attacked" | rename client_country as Country

[Adrian]

Thanks Martin. That pretty much gets me where I need to be.