Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:
splunk index="some index" sourcetype="some sourcetype" earliest=-24h
stats count(ip) by location
After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:
- location a ... 6
- location b ... 10
- location c ... 5
I get
What gives?
