Splunk Search

Same ip address in different host

Anto
Explorer

I want to catch from my index=ip the field value ip_address in common in one or more hosts.
I want to get something like this:
This IP ADDRESS is in common with 3 host 

and so have a list or a chart where i can see all the ip address in common in the hosts.

Don't know  how to get it, thank you in advantage.

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Anto
Explorer

Really thank you, is exactly what i was looking for. It works

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Manual Instrumentation with Splunk Observability Cloud: The What and Why

If you've ever worked with distributed systems, you’ve likely felt the pain of a frontend throwing errors, ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...