Splunk Search

How do I remove Fields "values"?

HarperWCurran
Engager

I am new to splunk and still wokring out the kinks however im wondering as to why i have the iplocation of clients and ect however i want to just select one country in country field however when i select one it gives me nothing how do i get around this p1.PNGp2.PNG

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Country is not in your events, it is added by the iplocation command, you should add a where command after iplocation

<search> | iplocation clientip | where Country="India" | geostats count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Country is not in your events, it is added by the iplocation command, you should add a where command after iplocation

<search> | iplocation clientip | where Country="India" | geostats count

HarperWCurran
Engager

Thank you!

 

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...