Splunk Search

Filter ip_city in timechart

gt2013
Engager

Yello,
Being new to Splunk and still amazed at its capabilities, I have this query and trying to filter out ip_city name 'OTHER' that keeps showing up:

source="/users/a/access" | localop | lookup geo ip as remoteip | search ip_city != "other" | timechart count by ip_city

No cigar 😕

Would anyone be able to help?
Thanks in advance.

0 Karma
1 Solution

lguinn2
Legend

Aha! I think the problem is that the timechart command sees more than 10 (the default number) of ip_city values, so it only shows the first 10 in the chart, and summarizes the remainder into an entry called "OTHER". That's why you can't eliminate it with your search! (nice try, tho!)

Take a look at the timechart command, and perhaps use the options to try it this way instead:

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| timechart limit=0 count by ip_city

I hope that will work for you! If not, perhaps there is a different problem. In that case, you might try this first, just to see what you get...

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| stats count by ip_city

View solution in original post

lguinn2
Legend

Aha! I think the problem is that the timechart command sees more than 10 (the default number) of ip_city values, so it only shows the first 10 in the chart, and summarizes the remainder into an entry called "OTHER". That's why you can't eliminate it with your search! (nice try, tho!)

Take a look at the timechart command, and perhaps use the options to try it this way instead:

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| timechart limit=0 count by ip_city

I hope that will work for you! If not, perhaps there is a different problem. In that case, you might try this first, just to see what you get...

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| stats count by ip_city

gkanapathy
Splunk Employee
Splunk Employee

or useother=false added to the timechart command if you only want the top 10.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...