I have logs in the following format
2010-06-17 02:04:55 user1 ip.add.ress.here GET /mysite/mypage.html
2010-06-17 02:04:59 user1 ip.add.ress.here POST /mysite/mypage2.html
2010-06-17 02:05:23 user2 ip.add.ress.here GET /mysite/mypage.html
What my question is, is there an easy way to search for all users that have logged in from multiple ip addresses, and also for all ip addresses that have been used by multiple users.
... | stats distinct_count(ipaddress) as dcip by user | where dcip > 1
... | stats distinct_count(user) as dcu by ipaddress | where dcu > 1
respectively will do it.
View solution in original post