It would appear that using ...| geostats isn't working as it used to anymore. I originally had a search like the following in order to visualize where users were logging in from:
(index="user_logins" session="*") OR (index="ssh" password="Accepted") | iplocation IP | table user lon lat | geostats globallimit=0 count by user
I originally ran into the problem where Splunk would truncate the data shown and found that globallimit=0 appeared to be a fix. Well, it's been about a month and the problem is back (even with globallimit=0). To be exact, Splunk decides to truncate the amount of data it shows after the job finishes. It looks perfectly fine while performing the search, but then it decides to only display the geo-ip location of two users rather than a hundred or so.
Has anyone ran into this problem or have any suggestions to fix this problem?
