Trying to write a simple query in Splunk 7.0. The idea is that it would count all the unique ip addresses based on a specific location. So my query would look like this:
splunk index="some index" sourcetype="some sourcetype" earliest=-24h
stats count(ip) by location
After 100 rows, and (by my eyes) at least 12 unique addresses... it counts 5. So instead of:
I get
What gives?
index="some index" sourcetype="some sourcetype" earliest=-24h
|stats count(ip) as ip_count dc(ip) as unique_ip_count by location
hi, @TitanAE
please provide your output details.
Okay... apparently verbose search really is slowing down my search.