Why is it showing more data after dc count with the right order?

[dieguiariel]

Hi! im working on an alert for access from different countries for certain users in a short time period. The alert and the search works fine but i will like to show more info when the alert triggers (source ip and time).

Here a sample of the event:

09:09:55,377 INFO [XX.XXX.XXXXXXX.cbapi.dao.login.LoginDAOImpl] (default task-34878) Enviamos parámetros: [authTipoPassword=E, authDato=4249929, authTipoDato=D, nroDocEmpresa=80097256-2, tipoDocEmpresa=D, authCodCanal=999, authIP=45.170.128.191, esDealer=N, dispositivoID=40ee57e1-e5eb-4b14-b7ef-9f0f8ccdf6c

2, dispositivoOS=null ]

Here the search:

index="XXXX" host="XXX.XXX.-*" sourcetype=XXXXXXCBAPI*  authDato authIP dao.login.LoginDAOImpl authIP=* authCodCanal=999 | iplocation authIP | eval Country = if(isnull(Country) OR Country="", "Unknown", Country) | stats
dc(Country) AS count
values(Country) AS country values(authIP) as authIP
latest(_time) AS latest
BY authDato | where count > 1 | eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S") | sort - latest

With this i get a result like this:

authdato | count | Country | authIP | latest

2363494 | 2 |   Argentina | 170.51.250.39 | 2023-03-15 09:09:09

                              Paraguay | 170.51.55.186

the thing is.. the ip address aren't aligned with the country for that ip, neither the time is aligned with the last Country or ip address.

Ive tried several things but still can't figure out how to correctly present the results (in the right order i mean)

[dieguiariel]

Hi! thank yoy both for the answer, it worked with list! 

[ITWhisperer · Accepted solution]

Use list() rather than values() - values() will put the values in (lexicographical) order and removes duplicates, whereas list() maintains the order and duplicates.

[richgalloway]

The values function returns unique values of a field in alphabetical order.  You can't change that.

Try the list function, instead, which return all values in the order they were found.  Only 100 values are returned, however.