Splunk Search

How to create a search to get it to display results when count of IP Address is exactly 2?

aikn061
Explorer

Hi Guys,

I already have a query below that gives me a table similar to the one on bottom.  I was wondering if there is a way to get it to display results when count of IP Address is exactly 2?   

Meaning show results when IP address = 2 otherwise dont show it.  So 3rd entry should not show but first two should.  

Please let me know if any ideas.  Appreciate your helps in advance.

 

 

 

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where count > 20

 

Account_Name EventID Message Count IP Address
SmithA 4771 Kerberos pre-authentication failed 5000 1.1.1.1
2.2.2.2
JohnsonX 4771 Kerberos pre-authentication failed 6000 3.3.3.3
4.4.4.4
washingtonZ 4771 Kerberos pre-authentication failed 7000 5.5.5.5
Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the mvcount function to find the number of IP addresses.

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where (count > 20 AND mvcount(IP_Address)=2)

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use the mvcount function to find the number of IP addresses.

index=EventLog source=security EventCode=4771
| stats count values(source) AS IP_Address BY Account_Name EventID Message
| where (count > 20 AND mvcount(IP_Address)=2)

 

---
If this reply helps you, Karma would be appreciated.

aikn061
Explorer

Thank you!  Worked like a charm.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...