Splunk Search

How to combine duplicate Latitude and longitude values in the stats tale of a cluster map

schalkrust
Engager

I just want to clean up my search of 'noise'as my stats table gets populated by duplicate values from the save latitude and longitude values.

index=newfortinet user=AARIBEB msg="URL belongs to a denied category in policy" direction=outgoing action=blocked
|stats sum(count) by dstip
|sort - count
|iplocation dstip
|where Country="Namibia"
|geostats count by Country globallimit=0
|fields - geobin

See attached result screanshot

alt text

Tags (1)
0 Karma

woodcock
Esteemed Legend

Just add this:

... | dedup Namibia latitude longitude
0 Karma

to4kawa
Ultra Champion
index=newfortinet user=AARIBEB msg="URL belongs to a denied category in policy" direction=outgoing action=blocked
|stats sum(count) by dstip
|sort - count
|iplocation dstip
|where Country="Namibia"
|geostats count by Country globallimit=0
|fields - geobin
|eval tmp=Namibia."_".latitude."_".longitude
|dedup tmp
|fields Namibia, latitude, longitude

Hi, @schalkrust
How about it?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...