mutiple search

[riposans]

Hello everyone,

 i need solution for this.

my data :

userID=text123 , login_time="2024-03-21 08:04:42.201000", ip_addr=12.3.3.21

userID=text123, login_time="2024-03-21 08:00:00.001000", ip_addr=12.3.3.45

userID=text123, login_time="2024-03-21 08:02:12.201000", ip_addr=12.3.3.21

userID=text123, login_time="2024-03-21 07:02:42.201000", ip_addr=12.3.3.34

i want get data, userID="text123 " AND in the last 5 minutes AND if mutiple ip

i used join,map,append but not solved.please help for SPL this

[bowesmana]

Try this - use your index and I assume that the event _time stamp is the login time.

index=bla userID=text123 earliest=-5m@m latest=@m
| stats dc(ip) as ips by userID
| where ips>1

If your events contain other info than just login details, then you may need to add login_time=* to the search