why geoip only shows some events but not all...? supposably it has to show 4 million events for a sourcetype, it only shows 19,000!!
See http://splunk-base.splunk.com/answers/37105/geoip-search-results-not-correct?page=1&focusedAnswerId=...
View solution in original post