I'm able to get the number of hits that come from each City using iplocation, but why do I get such a high number for VALUE?

[rana_nour]

index=gasf uri_path="*.aspx"  (( eventtype="Hub" ) AND eventtype=*)   | iplocation clientip | timechart span=1hr c by City limit=400 usenull=f

Here is my search. It gets the number of hits that come from each City. The issue is that it gets a large number for "VALUE". Need to know what does it indicate, how to resolve this issue, and if it can't be resolved, how can I hide the VALUE ?

[MuS · Accepted solution]

Hi rana_nour,

the VALUE field in the timechart output is related to events with no City value in it, for what ever reason (This must be checked and fixed by yourself). But you can simply add another filter to exclude them from the timechart like this:

index=gasf uri_path="*.aspx"  (( eventtype="Hub" ) AND eventtype=*)   | iplocation clientip | where City!="" | timechart span=1hr c by City limit=400 usenull=f

Hope that helps ...

cheers, MuS