Splunk Search

How to check a table for multiple mac addresses with the same IP

jhick
Observer

Currently my splunk search to get a list of macs of the security cameras with their respective IP is 

index = dhcp 00:04:7d 10.101.240.* |table dest_mac, dest_ip |dedup dest_ip | dedup dest_mac

How would I get it to check for  multiple mac addresses with the same IP. This will indicate that the IP is not fixed.

Thank you!

Labels (4)
Tags (4)
0 Karma

abowesman
Explorer

Try

 

| stats values(dest_mac) as MacAddresses by dest_ip

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...