Reporting

regroup items in cluster map

sweiland
Path Finder

Hi there,

Just a quick question on the cluster map that is not really displaying what we are aiming for...

We have a simple query which is then piped to iplocation then geostats as this:

 

 

query | iplocation myIP | geostats count by Country globallimit=0

 

 

We are trying to "regroup" items by Country, as it may seem obvious, but it is more difficult than expected.

Here is an example of the output (guess geobin/lat/lon is messing with us):

sweiland_0-1613460223181.png

Blue canada is splitted into 2 locations, and USA in at least 4, we would like to have a cluster more or less like the chloromap.

If we count by Country before geostats, it shows the expected result (in a table), but if we apply geostats it is splitted by location, any way to circumvent this ?

We tried to use another iplocation prefix, and geostats count by myCountry, does not work either 😞

 

Labels (1)
0 Karma
1 Solution

sweiland
Path Finder

Found the solution by using a lookup file

Idea is to stats count by country, and then lookup the latitude/longitude on the aggregated results, then pipe to geostats

Works well

View solution in original post

0 Karma

sweiland
Path Finder

Found the solution by using a lookup file

Idea is to stats count by country, and then lookup the latitude/longitude on the aggregated results, then pipe to geostats

Works well

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...