I am not getting iplocation working in this query:
tag= web | stats count by IP, sessionId | stats dc(IP) as count, values(IP) as clientIP by sessionId | where count> 5 | iplocation clientIP
I can see the country, city, region fields appear but they are not populated
But when I run the following search I get IP location working with the country, region etc fields populated.
tag= web | iplocation IP | table IP, Country
| mvexpand clientIP after your stats command and it should work. I don't believe iplocation works on multivalue fields
If your problem is resolved, please accept the answer to help future readers.