Splunk Search

How to show an IP is associated with multiple usernames

alexrod03
New Member

I have one source type and 2 field values, username and IP.
How do I show IP that is associated with multiple usernames.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@alexrod03,
Try

your search |stats dc(username) as count,values(username) as usernames by IP | where count > 1
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@alexrod03,
Try

your search |stats dc(username) as count,values(username) as usernames by IP | where count > 1
Happy Splunking!
0 Karma

alexrod03
New Member

That worked great. Thanks

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>