I'm fairly new to Splunk. I have a working local enterprise installation, and have installed Splunk App for Web Analytics, however, under Audience data by country, the data we see here doesn't appear to agree with what we know about the webserver logs we've imported..
Under Splunk App for Web Analytics Audience - we see the attached country order
However, when we run a custom report with our own filters / extractions for detecting bots (and our AWS Route53 health monitor), we get something like the following...
(this is not limited to page views). Country data here is still not what we would expect, varying significantly from Google analytics - this time with France at the top, however, the ratios here align with Google analytics if we consider the Google Analytic data correct (and ignore the country names in our own report).
1 Thailand 5,213(53.79%)
2 Myanmar (Burma) 658(6.79%)
3 Indonesia 553(5.71%)
4 Cambodia 518(5.35%)
5 United States 478(4.93%)
6 Nepal 223(2.30%)
7 Vietnam 197(2.03%)
8 Laos 196(2.02%)
9 India 163(1.68%)
10 Japan 144(1.49%)
This last set aligns more with what we know about our data.
So the question is - how could we unpick this in order to determine why the country report is so different from what we expect?
Any thoughts or suggestions greatly appreciated.
... View more