Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:
splunk index="some index" sourcetype="some sourcetype" earliest=-24h
stats count(ip) by location
After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:
index="some index" sourcetype="some sourcetype" earliest=-24h
|stats count(ip) as ip_count dc(ip) as unique_ip_count by location
please provide your output details.
Okay... apparently verbose search really is slowing down my search.