I want to catch from my index=ip the field value ip_address in common in one or more hosts.
I want to get something like this:
This IP ADDRESS is in common with 3 host
and so have a list or a chart where i can see all the ip address in common in the hosts.
Don't know how to get it, thank you in advantage.
Try this
... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
Really thank you, is exactly what i was looking for. It works
Try this
... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1