How to create a search to get it to display results when count of IP Address is exactly 2?

[aikn061]

Hi Guys,

I already have a query below that gives me a table similar to the one on bottom.  I was wondering if there is a way to get it to display results when count of IP Address is exactly 2?   

Meaning show results when IP address = 2 otherwise dont show it.  So 3rd entry should not show but first two should.  

Please let me know if any ideas.  Appreciate your helps in advance.

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where count > 20

Account_Name	EventID	Message	Count	IP Address
SmithA	4771	Kerberos pre-authentication failed	5000	1.1.1.1 2.2.2.2
JohnsonX	4771	Kerberos pre-authentication failed	6000	3.3.3.3 4.4.4.4
washingtonZ	4771	Kerberos pre-authentication failed	7000	5.5.5.5

[richgalloway · Accepted solution]

Use the mvcount function to find the number of IP addresses.

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where (count > 20 AND mvcount(IP_Address)=2)

[aikn061]

Thank you!  Worked like a charm.