Splunk Search

How to combine duplicate Latitude and longitude values in the stats tale of a cluster map

schalkrust
Engager

I just want to clean up my search of 'noise'as my stats table gets populated by duplicate values from the save latitude and longitude values.

index=newfortinet user=AARIBEB msg="URL belongs to a denied category in policy" direction=outgoing action=blocked
|stats sum(count) by dstip
|sort - count
|iplocation dstip
|where Country="Namibia"
|geostats count by Country globallimit=0
|fields - geobin

See attached result screanshot

alt text

Tags (1)
0 Karma

woodcock
Esteemed Legend

Just add this:

... | dedup Namibia latitude longitude
0 Karma

to4kawa
Ultra Champion
index=newfortinet user=AARIBEB msg="URL belongs to a denied category in policy" direction=outgoing action=blocked
|stats sum(count) by dstip
|sort - count
|iplocation dstip
|where Country="Namibia"
|geostats count by Country globallimit=0
|fields - geobin
|eval tmp=Namibia."_".latitude."_".longitude
|dedup tmp
|fields Namibia, latitude, longitude

Hi, @schalkrust
How about it?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...