Splunk Search

Count of values in from values() function

msmapper
Path Finder

hello there,

I am trying to create a search that will show me a list of ip's for logins. issue is i only want to see them if people logged from at least 2 ip's.

current search parms are

sourcetype=login LOGIN ip=* username=* |stats values(ip) AS IP_List by username

which works great by providing me

username IP_List
j@blah.com 1.2.3.4
b@duh.com 4.5.6.7
8.7.8.9
f@sigh.com 10.2.4.9

is there anyway to only show?

username IP_List count
b@duh.com 4.5.6.7 2
8.7.8.9

thanks in advance
jen

1 Solution

yannK
Splunk Employee
Splunk Employee

for the count of uniques values, use disctinct count dc(ip)
for count of all values, use count(ip)

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Commonstatsfunctions

sourcetype=login LOGIN
| stats values(ip) AS IP_List dc(ip) AS DISTINCT_IP by username

View solution in original post

yannK
Splunk Employee
Splunk Employee

for the count of uniques values, use disctinct count dc(ip)
for count of all values, use count(ip)

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Commonstatsfunctions

sourcetype=login LOGIN
| stats values(ip) AS IP_List dc(ip) AS DISTINCT_IP by username

cfernaca
Explorer

Perfecto, muchas gracias !!

0 Karma

msmapper
Path Finder

absolutely perfect!! looks my main problem i was doing the dc(ip) as a separate stats statement when trying to get the count. I added a |where DISTINCT_IP > 1 to get exactly what i needed.

thanks again!

Jen

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...