Splunk Search

Event and Statistics not the same- Geostats

Becherer
Explorer

When I perform a search, the "events tab" count match actual data. Once I add "| geostats latfield=Latitude longfield=Longitude " to the search box, to be able to display on map, the results in the "statistics tab" go up in count by 11 and is not giving actual results. How can I have the geomap command look at the events and not "statistics tab"?

Why does the statistics results add 11 results compared to the events tab?

Thanks

0 Karma

to4kawa
Ultra Champion

geostats

The reason is that the number of fields being aggregated is different from the number of events. (e.g. no field)

by the way, what's stats-agg-term? and is your search mode Verbose?

0 Karma

Becherer
Explorer

to4kawa

Is there a way for me to only aggregate the exact number of events?

0 Karma

to4kawa
Ultra Champion

simply,
geostats count latfield=Latitude longfield=Longitude

p.s. if you want to mention others, use @username not >

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...