Using Splunk to count within a search - users to ip addresses

[bnolen]

Hi all,

I have logs in the following format

2010-06-17 02:04:55 user1 ip.add.ress.here GET /mysite/mypage.html
2010-06-17 02:04:59 user1 ip.add.ress.here POST /mysite/mypage2.html
2010-06-17 02:05:23 user2 ip.add.ress.here GET /mysite/mypage.html

What my question is, is there an easy way to search for all users that have logged in from multiple ip addresses, and also for all ip addresses that have been used by multiple users.

[gkanapathy · Accepted solution]

... | stats distinct_count(ipaddress) as dcip by user | where dcip > 1

and

... | stats distinct_count(user) as dcu by ipaddress | where dcu > 1

respectively will do it.