You can do this:
sourcetype=your_sourcetype | eventstats dc(user) as dc_user by clientip | where dc_user > 2
You can do this:
sourcetype=your_sourcetype | eventstats dc(user) as dc_user by clientip | where dc_user > 2
Perfect!
Exactly, what was needed. Now he is going to read the documentation and learn search.
Thank you!
hello, example:
*xxx.xxx.xxx.xxx* - *user@domain.ru* [13/Jul/2014:04:02:27 +0400] "GET /src/?_task=mail&_action=check-recent&_mbox=INBOX&_list=1&_quota=1&_remote=1&_unlock=0&_=1405209744809 HTTP/1.1" 200 260
I need to display ip addresses (name - clientip) in log which was at over 2-3 user email (name in log - user)
Yes it is possible. If you could provide little more details like sample log events, we can help you to write the search.