geostats
Use this command to provide summary statistics, grouped by the Client Host Coordinates field. You can optionally group by additional fields. The output for this query includes the relevant geographic fields, along with one field for each aggregation.
Syntax
geostats [ include = client | server | client,server ] <stats_function> (<field_name>) [as new_field_name] [, <stats_function> (<field_name>) [as new_field_name]]* [by <field_name> [, <field_name>]*]OR
geostats include = custom [ city = <field_name> ] [ region = <field_name> ] [ country = <field_name> ] [ continent = <field_name> ] [ coordinates = <field_name> ] <stats_function> (<field_name>) [as new_field_name] [, <stats_function> (<field_name>) [as new_field_name]]* by <field_name> [, <field_name>]*Parameters
The following table lists the parameters used with this command, along with their descriptions.
| Parameter | Description |
|---|---|
|
|
Use this parameter to specify the field according to which you want the results to be grouped. |
|
|
Use this value to specify the new field name to display the result after applying the stats function on the field. |
You can use the functions that are associated with the
stats command with the
geostats command too. For details about the
functions and the examples of using the functions with the command,
see stats.
For an example of using this command, see:
The following query returns the count of fatal logs grouped by target name, type and Client Host Coordinates.
severity='fatal' | geostats count by target, 'target type'The following query returns the total count of logs grouped by Client Host Coordinates.
* | geostats countThe following query returns the count of database logs grouped by target name, severity and Server Host Coordinates.
'target type' = 'Database Instance' | geostats include=server count by target, severityThe following query returns the total count of logs grouped by Client Host Coordinates and Server Host Coordinates.
* | geostats include=client,server countThe following query returns the total count of logs grouped by Coordinates using fields from a lookup table.
* | lookup table = geomap select city, country, coordinates using 'Client Coordinates' = coordinates | geostats include = custom city = city country = country by coordinates count