I have list of events that have IP address
{
USERID: system01
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system03
browser: Chrome,
ip: 192.168.10.10
...}
{
USERID: system02
browser: Chrome,
ip: 192.168.11.10
...}
I want to get the events that has the number of ip only once
the output should only be
{
USERID: system01
browser: Chrome,
ip: 192.168.11.10
...}
as 192.168.10.10 is repeated twice it should be eliminated.
If you have IP address extracted into a field, let's say IP. You can append following to your search.
|eventstats count by IP | search count < 2
If you have IP address extracted into a field, let's say IP. You can append following to your search.
|eventstats count by IP | search count < 2