geostats

Use this command to provide summary statistics, grouped by the Client Host Coordinates field. You can optionally group by additional fields. The output for this query includes the relevant geographic fields, along with one field for each aggregation.

Syntax

geostats [ include = client | server | client,server ] <stats_function> (<field_name>) [as new_field_name] [, <stats_function> (<field_name>) [as new_field_name]]* [by <field_name> [, <field_name>]*]

OR

geostats include = custom [ city = <field_name> ] [ region = <field_name> ] [ country = <field_name> ] [ continent = <field_name> ] [ coordinates = <field_name> ] <stats_function> (<field_name>) [as new_field_name] [, <stats_function> (<field_name>) [as new_field_name]]* by <field_name> [, <field_name>]*

Parameters

The following table lists the parameters used with this command, along with their descriptions.

Parameter Description

field_name

Use this parameter to specify the field according to which you want the results to be grouped.

new_field_name

Use this value to specify the new field name to display the result after applying the stats function on the field.

Note

You can use the functions that are associated with the stats command with the geostats command too. For details about the functions and the examples of using the functions with the command, see stats.

For an example of using this command, see:

The following query returns the count of fatal logs grouped by target name, type and Client Host Coordinates.

severity='fatal' | geostats count by target, 'target type'

The following query returns the total count of logs grouped by Client Host Coordinates.

* | geostats count

The following query returns the count of database logs grouped by target name, severity and Server Host Coordinates.

'target type' = 'Database Instance' | geostats include=server count by target, severity

The following query returns the total count of logs grouped by Client Host Coordinates and Server Host Coordinates.

* | geostats include=client,server count

The following query returns the total count of logs grouped by Coordinates using fields from a lookup table.

* | lookup table = geomap select city, country, coordinates using 'Client Coordinates' = coordinates | geostats include = custom city = city country = country by coordinates count