| tstats summariesonly values(Authentication.app) as app, latest(Authentication.user_bunit) as user_bunit from datamodel=Authentication.Authentication by Authentication.user,Authentication.src _time span=1s | drop_dm_object_name("Authentication") | eventstats dc(src) as src_count by user | search src_count>1 | sort 0 + _time| get_asset(src) | iplocation src | eval session_lat=if(isnull(src_lat), lat, src_lat) | eval session_lon=if(isnull(src_long), lon, src_long) | eval session_city=if(isnull(src_city), City, src_city) | where isnotnull(session_lat) and isnotnull(session_lon) | sort 0 + _time | streamstats current=t window=2 earliest(session_lat) as prev_lat, earliest(session_lon) as prev_lon, earliest(session_city) as prev_city, earliest(_time) as prev_time, earliest(src) as prev_src, latest(user_bunit) as user_bunit by user | where (src!=prev_src) | globedistance(session_lat,session_lon,prev_lat,prev_lon,"m") | eval time_diff=if((_time-prev_time)==0, 1, _time - prev_time) | eval speed = round(distance*3600/time_diff,2)| where speed>1
... View more