Splunk Search

Same ip address in different host

Anto
Explorer

I want to catch from my index=ip the field value ip_address in common in one or more hosts.
I want to get something like this:
This IP ADDRESS is in common with 3 host 

and so have a list or a chart where i can see all the ip address in common in the hosts.

Don't know  how to get it, thank you in advantage.

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Anto
Explorer

Really thank you, is exactly what i was looking for. It works

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | stats values(host) as hosts by ip_address
| where mvcount(hosts) > 1
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...