Splunk Search

How do I remove Fields "values"?

HarperWCurran
Engager

I am new to splunk and still wokring out the kinks however im wondering as to why i have the iplocation of clients and ect however i want to just select one country in country field however when i select one it gives me nothing how do i get around this p1.PNGp2.PNG

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Country is not in your events, it is added by the iplocation command, you should add a where command after iplocation

<search> | iplocation clientip | where Country="India" | geostats count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Country is not in your events, it is added by the iplocation command, you should add a where command after iplocation

<search> | iplocation clientip | where Country="India" | geostats count

HarperWCurran
Engager

Thank you!

 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...