I would like to select for users that login from ip addresses that are far apart. The best idea that I have so far is to get the sum of stddev on both latitude and longitude grouped by username and get the top values. F.e like the query below:
| json auto
| lookup latitude, longitude from geo://location on ip=remote_address
| stddev(latitude, longitude) by username
But unfortunately, I can only stdev on 1 field, is there a way around?
Please sign in to leave a comment.