Thanks stefandagerman for your response.
But I'm still having some troubles. Please correct me if I'm doing something wrong.
In props.conf, I have the following (exactly)
LOOKUP-ip = geoip clientip AS ip OUTPUTNEW client_country AS country
LOOKUP-hq = regionhq name AS country OUTPUTNEW hq AS hq
With the above setting, following search return valid results
| stats count by country
OR
| stats count by country | lookup regionhq name AS country OUTPUT hq | stats sum(count) by hq
But the following does not return any results
| stats count by hq
Any idea where I'm wrong?
... View more