IP address search by a project ID

[the_gambler]

I have certain project IDs I'm trying to get a list of IP addresses from.

[gcusello]

Hi @the_gambler ,

as @ITWhisperer said, you didn't share suffieicnt information to help you.

I can suppose that you have a field called Project_ID and a field called IP_Address, in this case, try something like this:

index=your_index
| stats values(IP_Address) AS IP_Address BY Project_ID

Ciao.

Giuseppe

[ITWhisperer]

You haven't provided sufficient information for us to be able to help you - what ip addresses? how do they relate to the project ids? Can you share some anonymised examples of the events you are dealing with?