help with search request

[templier]

Hello.

Just starting to deal with complex query to splank, there is now a need to make a request that would be deduced from the log ip addresses that connect more than two users.

Is it possible?

Thank you.

[martin_mueller · Accepted solution]

You can do this:

sourcetype=your_sourcetype | eventstats dc(user) as dc_user by clientip | where dc_user > 2

[templier]

Perfect!
Exactly, what was needed. Now he is going to read the documentation and learn search.

Thank you!

[templier]

hello, example:

*xxx.xxx.xxx.xxx* - *user@domain.ru* [13/Jul/2014:04:02:27 +0400] "GET /src/?_task=mail&_action=check-recent&_mbox=INBOX&_list=1&_quota=1&_remote=1&_unlock=0&_=1405209744809 HTTP/1.1" 200 260

I need to display ip addresses (name - clientip) in log which was at over 2-3 user email (name in log - user)

[strive]

Yes it is possible. If you could provide little more details like sample log events, we can help you to write the search.