Hi Guys,
I already have a query below that gives me a table similar to the one on bottom. I was wondering if there is a way to get it to display results when count of IP Address is exactly 2?
Meaning show results when IP address = 2 otherwise dont show it. So 3rd entry should not show but first two should.
Please let me know if any ideas. Appreciate your helps in advance.
index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where count > 20
Account_Name | EventID | Message | Count | IP Address |
SmithA | 4771 | Kerberos pre-authentication failed | 5000 | 1.1.1.1 2.2.2.2 |
JohnsonX | 4771 | Kerberos pre-authentication failed | 6000 | 3.3.3.3 4.4.4.4 |
washingtonZ | 4771 | Kerberos pre-authentication failed | 7000 | 5.5.5.5 |
Use the mvcount function to find the number of IP addresses.
index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where (count > 20 AND mvcount(IP_Address)=2)
Use the mvcount function to find the number of IP addresses.
index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where (count > 20 AND mvcount(IP_Address)=2)
Thank you! Worked like a charm.