How do you use the where clause in a cluster map?

everynameIwanti — Wed, 21 Nov 2018 17:57:14 GMT

I'm trying to make a cluster map in Splunk by their IP address.

I grouped the IP by id number, and I want to only show the cluster which each an ID has more than 3 IP addressess.

I have the following code:

index="xxx"  id != "-"  | iplocation ip | geostats dc(ip) by id

And I tried to make a variable name for dc(ip) (like dc(ip) as ipCount) so that I can use it in the where clause (where ipCount > 3), but unfortunately geostats doesn't allow me to rename.

Does anybody know how or where to add a where clause or is there another way of making the map?

Thank you

Re: How do you use the where clause in a cluster map?

adonio — Wed, 21 Nov 2018 19:53:32 GMT

without testing, maybe something along those lines:

 index="xxx" id != "-" 
| eventstats dc(ip) as unique_ips by id 
| where unique_ips > 3
| iplocation ip | geostats max(unique_ips)  by id

hope it helps

topic How do you use the where clause in a cluster map? in Splunk Search

How do you use the where clause in a cluster map?

Re: How do you use the where clause in a cluster map?