How to create a search with several events from one host with different condition?

[bosseres]

Hello, everyone

I need help from community.

I want to make search that will find two+ events from same host, for example user=David action=success AND user=Mike, but this events must be only on one host.
Thank you in advance.

[gcusello]

Hi @bosseres,

sorry but your requrest isn't so clear:

do you want to find the users that have logins to more hosts or hosts with logins from more users?

Anyway, the approach is the same, the change is in the use of fields:

multiple user logins for the same host

your_search
| stats dc(users) AS dc_users values(users) As users BY host
| where dc_users>1

multiple hosts for the same user

your_search
| stats dc(host) AS dc_host values(host) As host BY user
| where dc_host>1

In general I hint to follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchTutorial/WelcometotheSearchTutorial) to understand how to create a search in Splunk.

Ciao.

Giuseppe