how can i filter abnormal login from same user different IP address ?

[lllidan]

I have to say I'm a layman on Splunk. but i got a requirement from my boss , i need to search the same user login via different IP addresses during five minutes.
i admire the man who can help me .

[sshelly_splunk]

Your base search will be specific to your environment (i.e. Windows Event codes, ssh login messages, etc), but if you get your base search, you can than do something like:
"yoursearch" | chart count over user by host
Again, it will depend on your source data. If you give a bit more info (sourcetypes, etc), be happy to respond.

[kamlesh_vaghela]

@lllidan,

can you share more information about events or provide sample event?