How to find the events contain different fields while they have the same value in another field?

[weikuanl]

I got the following log events:

=====

User:A IP_address:10.0.0.1

User:B IP_address:10.0.0.2

User:C IP_address:10.0.0.3

User:A IP_address:20.1.1.1

User:C IP_address:10.0.0.3

=====

As shown above, event 1 and event 4 both have the value "A" in User field, but they got different values in "IP_address" field. What search command should I use to filter the logs and find out event pairs like event 1 and event 4 above (have the same value in User field but different values in IP_address field)? Thanks!

[ayme]

sourcetype=your_sourcetype | stats values(IP_address) as ips by User | where mvcount(ips)>1

...should do the trick.

[weikuanl]

Thanks a lot, it works!