How to compare values of a field if they are same and save the match or non-match result in different field.

[arrangineni]

I am trying to compare the values of a field IP and trigger the alert if the values are different based on the UserName field and Sesson Id.

My search looks like the below
index=758.......
| stats count(user) as count , list(name) as UserName , list(IP) as IP by SessionId | where count>1
| eval Match=if(IP=IP, "Match", "No Match")
| table ASP_NET_SessionId UserName IP Match

Can someone help me with the changes to this query so that I can know which User is using which IP's and trigger an alert if they are using different set of IP's?

[renjith_nair]

@arrangineni,

If you are looking for a user who uses multiple IPs to login , try this

index="your index"|stats values(IP) as IPList,values(SessionId) as SessionId  by user | where mvcount(IPList) > 1

If you want to check for multiple IPs for same session id which is possible (proxy,ISP routing,etc), add SessionId also to the by clause

[arrangineni]

I am trying to find out a scenario where two different users use same session ID from different IP's ..

Currently my results looks like this
SessionID Username IP
abc... xyz 12.34.65.68
abc... uyw 64.5.565.75

So in the above scenario both users use same IP's with different names using same session ID, I want the alert when the two users use different IP's using same session ID, Can you help with this?

[renjith_nair]

@arrangineni,

index="your index"|stats dc(IP) as ipcount,values(name) as UserName by SessionId
  |where ipcount > 1

Above should result if one session id has more than one distinct IP.