How do you show unique downloads and their location using the geomap command?

[mistydennis]

I am trying to show unique downloads and their location using the geomap command.

Without geomap, my download query is:

DocumentName=* response_code=200 
| stats count by src_ip, IPLocation
| stats count AS "Unique Downloads" by IPLocation

This query shows 5,224 downloads for one day.

I'm trying to reproduce the query using geomap to show the location. With geomap, my query is:

PublicationId=* response_code=200 
| search IPLocation=External 
| iplocation src_ip
| geostats count by Country globallimit=0 
| fields - geobin
| addcoltotals

This query produces 96,170 downloads for the day.

Can anyone help me understand where the discrepancy is? And how I can incorporate the query I use for downloads into the geomap query?

[joebisesi]

A couple of items jump out at me that could cause the discrepancy:
1. Your first query is looking for DocumentName=* and you are counting "Unique Downloads" 
2. Your second query is looking for PublicationId=* and it appears it is counting src_ip by Country. Also you are searching on IPLocation=External. The addcoltotals at the end may be adding all of the columns.`enter code here`

Without see the results of the data sets, I would recommend keeping the search query as close to identical as possible.

Any chance you can post a 'cleaned up' version of the of an event or two from each search?

[mistydennis]

Apologies - I must have been very tired when I wrote query #2:

    DocumentName=* response_code=200 
     | iplocation src_ip
     | geostats count by Country globallimit=0 
     | fields - geobin
     | addtotals

Results of these two searches:

Search 1
IPLocation Unique Downloads

External 5200
Internal 24
TOTALS 5224

Search 2 is too large to post here since it lists all countries and the downloads, but the total results are 96,170.

Both searches should give me the same 5,224 results (basically counting every unique IP), so I don't understand where I've gone wrong.