Splunk Search
Highlighted

How to show an IP is associated with multiple usernames

New Member

I have one source type and 2 field values, username and IP.
How do I show IP that is associated with multiple usernames.

0 Karma
Highlighted

Re: How to show an IP is associated with multiple usernames

SplunkTrust
SplunkTrust

@alexrod03,
Try

your search |stats dc(username) as count,values(username) as usernames by IP | where count > 1

View solution in original post

0 Karma
Highlighted

Re: How to show an IP is associated with multiple usernames

New Member

That worked great. Thanks

0 Karma