I have this search which shows the user sessions count by Country for the date range specified. I am trying to filter only on those users that have sessions in multiple countries. Any suggestions?
index=firewall vpn "Session disconnected" | iplocation IP
| fields user, Country | stats count as EvtCounts by user, Country
| sort -EvtCounts
| eval EvtCatCnt = Country." (".EvtCounts.")"
| stats sum(EvtCounts) as Total_Events, values(EvtCatCnt) as Country by user
| sort -Total_Events
| eval User_Count = user." (".Total_Events.")"
| table user, Country
Current results look like this:
user Country
bob United States (1)
jane United States (2)
tarzan Mexico (14)
United States (1)
Only want to return results like tarzan.
↧