I want to catch from my index=ip the field value ip_address in common in one or more hosts.I want to get something like this:This IP ADDRESS is in common with 3 host
and so have a list or a chart where i can see all the ip address in common in the hosts.Don't know how to get it, thank you in advantage.
... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
View solution in original post
Really thank you, is exactly what i was looking for. It works