Splunk Search

Event and Statistics not the same- Geostats

Explorer

When I perform a search, the "events tab" count match actual data. Once I add "| geostats latfield=Latitude longfield=Longitude " to the search box, to be able to display on map, the results in the "statistics tab" go up in count by 11 and is not giving actual results. How can I have the geomap command look at the events and not "statistics tab"?

Why does the statistics results add 11 results compared to the events tab?

Thanks

0 Karma

SplunkTrust
SplunkTrust

geostats

The reason is that the number of fields being aggregated is different from the number of events. (e.g. no field)

by the way, what's stats-agg-term? and is your search mode Verbose?

0 Karma

Explorer

to4kawa

Is there a way for me to only aggregate the exact number of events?

0 Karma

SplunkTrust
SplunkTrust

simply,
geostats count latfield=Latitude longfield=Longitude

p.s. if you want to mention others, use @username not >

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!