How to find ip addresses which have both received and sent a message?

[masoud]

It is sort of like multiplying the set with itself and getting a subset in mathematical term.

my data is sth like this

src_ip    dst_ip time X Y

1.1.1.1   2.2.2.2 1pm .. ...

2.2.2.2   3.3.3.3  3pm .. ...

[PickleRick]

If I understand you correctly, you have in your events a source and destination fields and you want to find values which are present in both of those fields within your time range (which would mean that there was a connection to such an IP as well as from it).

There are probably many different approaches to such problem but I'd simply do

<your search>
| stats values(src_ip) as src_ip values(dst_ip) as dst_ip
| transpose
| rename "row 1" as IP
| mvexpand IP
| stats count by IP
| where count=2

[VatsalJagani]

@masoud - This would be the simplest mathematical way to do it. (In Splunk though there could be a better way of doing depending on the data.)

| set intersect [<your-search> | dedup src_ip | table src_ip] [<your-search> | dedup dest_ip | table dest_ip]

I hope this helps!!! Karma would be appreciated!!!

[masoud]

Thx mate. I update the question with more information about my data. could you please have a look?

[yuanliu]

To get help in search forum, you really want to illustrate your data, or at least let people know which application/log your are referring to and pray that somebody here has worked on that same application/log.

[masoud]

Thx mate. I update the question with more information about my data. could you please have a look?

[yuanliu · Accepted solution]

VatsalJagani and PickleRick's answers all should work.  Here's an alternative:

| stats values(src_ip) as src_ip values(dst_ip) as dst_ip
| eval src_ip_in_dst_ip = mvmap(src_ip, if(isnull(mvfind(dst_ip, "^" . src_ip . "$")), null(), src_ip))

Output using your sample data is

src_ip	dst_ip	src_ip_in_dst_ip
1.1.1.1 2.2.2.2	2.2.2.2 3.3.3.3	2.2.2.2