All Apps and Add-ons

Cluster map not showing all countries

aba83
Explorer

Hi all,
I'm trying to create a cluster map out of this search string. It looks at distinct user logins from each country. When I run this string, I get a return of about 15 different countries that all have a different count.

(index=mensa_exchange-prod sourcetype=iis cs_uri_stem="/owa/auth.owa" NOT LogoffReason=* OriginalIP=*)
     OR (index=mensa_radius-prod acct_status_type=1 acct_delay_time=0 vendor=Reserved NOT Wireless) OR (index=mensa_exchange-prod cs_User_Agent="Microsoft+Office*" sc_status=200 cs_username=*)
     | append [ search index=mensa_radius-prod vendor=Microsoft NOT Wireless 
               | transaction user, Client_Friendly_Name maxspan=1 startswith=acct_session_id=* endswith=action=success ]
     | eval clientIP=if(index="mensa_exchange-prod",OriginalIP,tunnel_client_endpoint)
     | rename cs_username AS User
     | iplocation clientIP
     | search Country=*
     | rex field=user "\w{3}\\\(?<user>\S+)" 
     | eval User=lower(user) 
     | stats dc(User) by Country

When I change the "stats" command to "geostats" it only shows logins from the US for some reason. What am I missing? Thanks in advance.

0 Karma

DalJeanis
Legend

First, fix the case of the fields named User or user, then rerun.

If you are still having problems, post again.

0 Karma

aba83
Explorer

What did you mean by fix the case of the fields named User?

0 Karma

DalJeanis
Legend

@aba83 - sorry for the delay. Hopefully you've figured it out by now. You have lower case user in line 4 which gets used as source for the rex in line 9 and overridden by its output, upper case in line 6 which gets overridden by line 10 and then used in line 11.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...