https://community.splunk.com/t5/Splunk-Search/iplocation-when-outputting-in-command-stats/m-p/548012#M155401 <P>Apparently, the <FONT face="courier new,courier">iplocation</FONT> command can't handle a multi-value field.&nbsp; Try putting <FONT face="courier new,courier">iplocation</FONT> before <FONT face="courier new,courier">stats</FONT>.</P><LI-CODE lang="markup">| search...... | iplocation remip | stats count(tunnelid) as sessioncount, values(*) as * by user</LI-CODE><P>&nbsp;</P> Thu, 15 Apr 2021 12:53:39 GMT richgalloway 2021-04-15T12:53:39Z https://community.splunk.com/t5/Splunk-Search/iplocation-when-outputting-in-command-stats/m-p/548002#M155396 <P>Hello everyone,<BR />Someone may already be doing the output of grouped events with the definition of location by ip.</P><P>How not to lose location data when grouping events ?<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="location.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/13782i3E72D905F4854252/image-size/large?v=v2&amp;px=999" role="button" title="location.png" alt="location.png" /></span></P><P>In my request spl it is<BR /><BR /></P><P><STRONG><EM>| search......</EM></STRONG><BR /><STRONG><EM>|stats count(tunnelid) as sessioncount, values(StartTime) as StartTime, values(tunnelid) as tunnelid, values(tunnelip) as tunnelip, values(remip) as remip, values(vendor_action) as vendor_action by user</EM></STRONG><BR /><STRONG><EM>| iplocation&nbsp;remip</EM></STRONG></P><P>Of course, when displaying one type, the location IP is displayed.</P><P>How to display data on the location of each IP in grouped events ?</P><P>&nbsp;</P> Thu, 15 Apr 2021 11:22:28 GMT https://community.splunk.com/t5/Splunk-Search/iplocation-when-outputting-in-command-stats/m-p/548002#M155396 nalia_v 2021-04-15T11:22:28Z https://community.splunk.com/t5/Splunk-Search/iplocation-when-outputting-in-command-stats/m-p/548012#M155401 <P>Apparently, the <FONT face="courier new,courier">iplocation</FONT> command can't handle a multi-value field.&nbsp; Try putting <FONT face="courier new,courier">iplocation</FONT> before <FONT face="courier new,courier">stats</FONT>.</P><LI-CODE lang="markup">| search...... | iplocation remip | stats count(tunnelid) as sessioncount, values(*) as * by user</LI-CODE><P>&nbsp;</P> Thu, 15 Apr 2021 12:53:39 GMT https://community.splunk.com/t5/Splunk-Search/iplocation-when-outputting-in-command-stats/m-p/548012#M155401 richgalloway 2021-04-15T12:53:39Z