Reporting

regroup items in cluster map

sweiland
Path Finder

Hi there,

Just a quick question on the cluster map that is not really displaying what we are aiming for...

We have a simple query which is then piped to iplocation then geostats as this:

 

 

query | iplocation myIP | geostats count by Country globallimit=0

 

 

We are trying to "regroup" items by Country, as it may seem obvious, but it is more difficult than expected.

Here is an example of the output (guess geobin/lat/lon is messing with us):

sweiland_0-1613460223181.png

Blue canada is splitted into 2 locations, and USA in at least 4, we would like to have a cluster more or less like the chloromap.

If we count by Country before geostats, it shows the expected result (in a table), but if we apply geostats it is splitted by location, any way to circumvent this ?

We tried to use another iplocation prefix, and geostats count by myCountry, does not work either 😞

 

Labels (1)
0 Karma
1 Solution

sweiland
Path Finder

Found the solution by using a lookup file

Idea is to stats count by country, and then lookup the latitude/longitude on the aggregated results, then pipe to geostats

Works well

View solution in original post

0 Karma

sweiland
Path Finder

Found the solution by using a lookup file

Idea is to stats count by country, and then lookup the latitude/longitude on the aggregated results, then pipe to geostats

Works well

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...