All Apps and Add-ons

What counts as a "distinct location" in the Google Maps module?

NK_1
Path Finder
In the Google Maps display, we see "xxx results with location information ( yyy distinct locations) over all time".

What constitutes a "distinct location" ? e.g.

... ip starttime=03/23/2011:08:00:00 endtime=03/24/2011:08:00:00  | stats count(ip)
--> 98346

And the unique IPs for that same result set:

... ip starttime=03/23/2011:08:00:00 endtime=03/24/2011:08:00:00  | dedup ip | stats count(ip)
--> 46411

I've also verified that "... | dedup ip | stats count(ip)" returns the same value as "... |  stats distinct_count(ip)"

Using the Google Maps module, I see the former query has 14085 distinct locations:

... ip starttime=03/23/2011:08:00:00 endtime=03/24/2011:08:00:00  | geoip ip
--> 95393 results with location information ( 14085 distinct locations) over all time

One would imagine removing duplicate IPs should not change the number of distinct locations, but it does (increases to 14165):

... ip starttime=03/23/2011:08:00:00 endtime=03/24/2011:08:00:00  | dedup ip | geoip ip
--> 46243 results with location information ( 14165 distinct locations) over all time
1 Solution

ziegfried
Influencer

A distinct locations is a unique combination of the latitude and longitude values (ie. the values of the fields _lat and _lng). It's calculated by appending | stats count as _geo_count by _lat,_lng as a postprocess to the search.

The only reason I can imagine that would explain those results is that the geoip commands somehow failed (crashed) on some of those IP values. The next version should fix this though.

Also in the upcomming version of the Google Maps there will be a single field _geo which will contain both latitude and longitude values separated by comma.

View solution in original post

0 Karma

ziegfried
Influencer

A distinct locations is a unique combination of the latitude and longitude values (ie. the values of the fields _lat and _lng). It's calculated by appending | stats count as _geo_count by _lat,_lng as a postprocess to the search.

The only reason I can imagine that would explain those results is that the geoip commands somehow failed (crashed) on some of those IP values. The next version should fix this though.

Also in the upcomming version of the Google Maps there will be a single field _geo which will contain both latitude and longitude values separated by comma.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...