As in subject, I run the following command: MY_SEARCH | iplocation allfields=true clientip | table lat lon And the table is empty. I have verified that clientip does contain values, and that other fields like "City", "City1" and "City2" contain values. I've also found that the prefix=some_prefix_ option for the "iplocation" command does not work either. Am I doing something wrong? ... View more

I have a field "LYC_USERNAME" that shows up in our logs. In order to determine the total number of distinct users of our system, I would like to sum all distinct values of that field over a custom time range (or over all time). I have managed to determine the total new users by running: | stats dc(LYC_USERNAME) as ucount but this gives me a single number. I would like to see how the number increases over time by plotting it on a chart. Appending | timechart ucount to the end of the search query does not work, unfortunately. Thanks! ... View more