Splunk Search

Count of values in from values() function

msmapper
Path Finder

hello there,

I am trying to create a search that will show me a list of ip's for logins. issue is i only want to see them if people logged from at least 2 ip's.

current search parms are

sourcetype=login LOGIN ip=* username=* |stats values(ip) AS IP_List by username

which works great by providing me

username IP_List
j@blah.com 1.2.3.4
b@duh.com 4.5.6.7
8.7.8.9
f@sigh.com 10.2.4.9

is there anyway to only show?

username IP_List count
b@duh.com 4.5.6.7 2
8.7.8.9

thanks in advance
jen

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

for the count of uniques values, use disctinct count dc(ip)
for count of all values, use count(ip)

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Commonstatsfunctions

sourcetype=login LOGIN
| stats values(ip) AS IP_List dc(ip) AS DISTINCT_IP by username

View solution in original post

yannK
Splunk Employee
Splunk Employee

for the count of uniques values, use disctinct count dc(ip)
for count of all values, use count(ip)

see http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Commonstatsfunctions

sourcetype=login LOGIN
| stats values(ip) AS IP_List dc(ip) AS DISTINCT_IP by username

View solution in original post

cfernaca
New Member

Perfecto, muchas gracias !!

0 Karma

msmapper
Path Finder

absolutely perfect!! looks my main problem i was doing the dc(ip) as a separate stats statement when trying to get the count. I added a |where DISTINCT_IP > 1 to get exactly what i needed.

thanks again!

Jen

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!