Splunk Search

Show only NON distinct values for a given field.

soundchaos
Path Finder

I am looking to compare a list of non unique usernames with unique IP's, and specifically analyze the occurences where any users have logged in with multiple ips.
So far I have:

index="iis_logs" source="url.com" NOT cs_username="-" | table cs_username, c_ip | dedup c_ip

A given username can be all letters, all numbers, or a combination of both, so the "where cs_username > 1 doesn't seem to work.

I also do want to see the actual username, so a stats command that only shows how many ips a given user logged into doesnt work either.

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

index="iis_logs" source="url.com" NOT cs_username="-" | stats values(c_ip) as c_ip by cs_username | where mvcount(c_ip) > 1

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

index="iis_logs" source="url.com" NOT cs_username="-" | stats values(c_ip) as c_ip by cs_username | where mvcount(c_ip) > 1

soundchaos
Path Finder

This is exactly what I needed, with a better method that I was trying before. Thank you!

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...