I have a timechart that visualizes the monthly count of unique locations accessed, but I need to remove the first (in order of time) 10,000 unique locations. Here is my original search that builds the timechart:
search resulting in events with various Latitude and Longitude fields, some unique
| eval LatNormalized=round(Latitude,5)
| eval LongNormalized=round(Longitude,5)
| eval LatLongNormalized=LatNormalized+","+LongNormalized
| dedup LatLongNormalized sortby -LatNormalized,-LongNormalized
| timechart span=1mon count(LatLongNormalized)
I tried to use the following to at least identify where the 10k mark was hit, and I could then just modify my time range to exclude that, however it isn't working:
same search base as above
| eval LatNormalized=round(Latitude,5)
| eval LongNormalized=round(Longitude,5)
| eval LatLongNormalized=LatNormalized+","+LongNormalized
| dedup LatLongNormalized sortby -LatNormalized,-LongNormalized, -date_month
| eventstats count(LatLongNormalized) as countLatLongNormalized
| streamstats range(countLatLongNormalized) as countRange
| head (countRange<10000)
This doesn't appear to be doing what I expected either, so I'm thinking I'm going about this completely wrong. Does anyone know how I could eliminate the results from my search containing the first 10,000 unique values of LatLongNormalized and only chart the subsequent counts?
... View more