Splunk Search

Using Splunk to count within a search - users to ip addresses

Path Finder

Hi all,

I have logs in the following format

2010-06-17 02:04:55 user1 ip.add.ress.here GET /mysite/mypage.html
2010-06-17 02:04:59 user1 ip.add.ress.here POST /mysite/mypage2.html
2010-06-17 02:05:23 user2 ip.add.ress.here GET /mysite/mypage.html

What my question is, is there an easy way to search for all users that have logged in from multiple ip addresses, and also for all ip addresses that have been used by multiple users.

1 Solution

Splunk Employee
Splunk Employee
... | stats distinct_count(ipaddress) as dcip by user | where dcip > 1

and

... | stats distinct_count(user) as dcu by ipaddress | where dcu > 1

respectively will do it.

View solution in original post

Splunk Employee
Splunk Employee
... | stats distinct_count(ipaddress) as dcip by user | where dcip > 1

and

... | stats distinct_count(user) as dcu by ipaddress | where dcu > 1

respectively will do it.

View solution in original post