Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why is geostats not working when used in a base search?

$
0
0
Hi all, I've created a dashboard that has multiple panels using essentially the same search, so I decided to try using a base search to cut down on resource usage. Unfortunately I've noticed that when using the base search with `geostats` in the post process search, the results don't match compared with using the whole search in the map panel. If I click on the magnifying glass on the map panel and open it in search, it works as expected again as it's used the base search + the post process search to re-create the whole search. Any ideas what might be causing this or how I can adjust my base search to fix it? Here's the (sanitised) code for base search and post process search map panel: **Base search:** index=* sourcetype="source1" | transaction user_id maxspan=1s | iplocation c_ip | where field_1 NOT null$field1.earliest$$field1.latest$ **Post process search:**geostats latfield=lat, longfield=lon count by City globallimit=0 Any guidance would be appreciated. Thanks, Ted Edited to add: The base search is working exactly as expected on other panels that display a table of results or a single value (using stats count).

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>