https://community.splunk.com/t5/Reporting/regroup-items-in-cluster-map/m-p/540209#M8773 <P>Found the solution by using a lookup file</P><P>Idea is to stats count by country, and then lookup the latitude/longitude on the aggregated results, then pipe to geostats</P><P>Works well</P> Wed, 17 Feb 2021 09:16:09 GMT sweiland 2021-02-17T09:16:09Z https://community.splunk.com/t5/Reporting/regroup-items-in-cluster-map/m-p/540056#M8771 <P>Hi there,</P><P>Just a quick question on the cluster map that is not really displaying what we are aiming for...</P><P>We have a simple query which is then piped to iplocation then geostats as this:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">query | iplocation myIP | geostats count by Country globallimit=0</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>We are trying to "regroup" items by Country, as it may seem obvious, but it is more difficult than expected.</P><P>Here is an example of the output (guess geobin/lat/lon is messing with us):</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sweiland_0-1613460223181.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12955iF89C1904053E6C9A/image-size/medium?v=v2&amp;px=400" role="button" title="sweiland_0-1613460223181.png" alt="sweiland_0-1613460223181.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">sweiland_0-1613460223181.png</span></span></P><P>Blue canada is splitted into 2 locations, and USA in at least 4, we would like to have a cluster more or less like the chloromap.</P><P>If we count by Country before geostats, it shows the expected result (in a table), but if we apply geostats it is splitted by location, any way to circumvent this ?</P><P>We tried to use another iplocation prefix, and geostats count by myCountry, does not work either <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P><P>&nbsp;</P> Tue, 16 Feb 2021 07:27:06 GMT https://community.splunk.com/t5/Reporting/regroup-items-in-cluster-map/m-p/540056#M8771 sweiland 2021-02-16T07:27:06Z https://community.splunk.com/t5/Reporting/regroup-items-in-cluster-map/m-p/540209#M8773 <P>Found the solution by using a lookup file</P><P>Idea is to stats count by country, and then lookup the latitude/longitude on the aggregated results, then pipe to geostats</P><P>Works well</P> Wed, 17 Feb 2021 09:16:09 GMT https://community.splunk.com/t5/Reporting/regroup-items-in-cluster-map/m-p/540209#M8773 sweiland 2021-02-17T09:16:09Z