Splunk Search
Highlighted

Filter ip_city in timechart

Engager

Yello,
Being new to Splunk and still amazed at its capabilities, I have this query and trying to filter out ip_city name 'OTHER' that keeps showing up:

source="/users/a/access" | localop | lookup geo ip as remoteip | search ipcity != "other" | timechart count by ipcity

No cigar 😕

Would anyone be able to help?
Thanks in advance.

0 Karma
Highlighted

Re: Filter ip_city in timechart

Legend

Aha! I think the problem is that the timechart command sees more than 10 (the default number) of ip_city values, so it only shows the first 10 in the chart, and summarizes the remainder into an entry called "OTHER". That's why you can't eliminate it with your search! (nice try, tho!)

Take a look at the timechart command, and perhaps use the options to try it this way instead:

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| timechart limit=0 count by ip_city

I hope that will work for you! If not, perhaps there is a different problem. In that case, you might try this first, just to see what you get...

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| stats count by ip_city

View solution in original post

Highlighted

Re: Filter ip_city in timechart

Legend

or useother=false added to the timechart command if you only want the top 10.

0 Karma