About Geolocation usage

Comments

1 comment

  • Avatar
    Monty Yao

    Hi Chaitanya,

    You can achieve the above with a JOIN query.. for example, join the first condition with the second by user name.

    | parse "IP <*>" as address | parse "User <*>" as user
    | lookup latitude, longitude, country_code, country_name, city, postal_code from geo://location on ip = address

    | join (count_distinct(longitude,latitude) group by user | where _count_distinct > 1) as a,
    (count by user, country_name, city) as b on a.user=b.user

    | fields b_user, b_country_name, b_city, b__count

     

     

    You can also use the filter operator, like this..

    | parse "IP <*>" as address | parse "User <*>" as user
    | lookup latitude, longitude, country_code, country_name, city, postal_code from geo://location on ip = address

    | count by user, country_name, city, longitude, latitude
    | filter user in (count_distinct(longitude,latitude) group by user | where _count_distinct > 1)

    Hope these helps,

    Monty

     

    0
    Comment actions Permalink

Please sign in to leave a comment.