I'm trying to show the count of the number of hosts in an area using a cluster map.
I have added a lookup CSV file with the hostname, city belonging, lat, and long
But when I try the below query
index="*" | lookup host_loc.csv host| geostats latfield="latitude" longfield="longitude" count by city
I get the output as
in visualization, it takes only one host linked to city Maynard and displays the details on the map
Is geostat linked to my IP? even though I change the city Maynard with the different hostname it is taking the count of that hostname only
It's weird can anyone explain why this is happening?
[| inputlookup host_loc.csv
| table host ]
| geostats latfield="latitude" longfield="longitude" count by city
no, it is not working
even the count is also not showing