Splunk Search

Same ip address in different host

Anto
Explorer

I want to catch from my index=ip the field value ip_address in common in one or more hosts.
I want to get something like this:
This IP ADDRESS is in common with 3 host 

and so have a list or a chart where i can see all the ip address in common in the hosts.

Don't know  how to get it, thank you in advantage.

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Anto
Explorer

Really thank you, is exactly what i was looking for. It works

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...