Splunk Search

Same ip address in different host

Anto
Explorer

I want to catch from my index=ip the field value ip_address in common in one or more hosts.
I want to get something like this:
This IP ADDRESS is in common with 3 host 

and so have a list or a chart where i can see all the ip address in common in the hosts.

Don't know  how to get it, thank you in advantage.

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Anto
Explorer

Really thank you, is exactly what i was looking for. It works

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!