Splunk Search

How to create a search to get it to display results when count of IP Address is exactly 2?

aikn061
Explorer

Hi Guys,

I already have a query below that gives me a table similar to the one on bottom.  I was wondering if there is a way to get it to display results when count of IP Address is exactly 2?   

Meaning show results when IP address = 2 otherwise dont show it.  So 3rd entry should not show but first two should.  

Please let me know if any ideas.  Appreciate your helps in advance.

 

 

 

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where count > 20

 

Account_Name EventID Message Count IP Address
SmithA 4771 Kerberos pre-authentication failed 5000 1.1.1.1
2.2.2.2
JohnsonX 4771 Kerberos pre-authentication failed 6000 3.3.3.3
4.4.4.4
washingtonZ 4771 Kerberos pre-authentication failed 7000 5.5.5.5
Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the mvcount function to find the number of IP addresses.

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where (count > 20 AND mvcount(IP_Address)=2)

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use the mvcount function to find the number of IP addresses.

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where (count > 20 AND mvcount(IP_Address)=2)

 

---
If this reply helps you, Karma would be appreciated.

aikn061
Explorer

Thank you!  Worked like a charm.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...