I have one source type and 2 field values, username and IP.
How do I show IP that is associated with multiple usernames.
@alexrod03,
Try
your search |stats dc(username) as count,values(username) as usernames by IP | where count > 1
@alexrod03,
Try
your search |stats dc(username) as count,values(username) as usernames by IP | where count > 1
That worked great. Thanks