Query to generate multiple countries authentication data

InsightIDR Log Search
1

Hi Everyone. I am new on the Insight Platform. I am looking for a help on a query to export multiple countries authentication data.

2

Hello @tmoosun1,

Try the following “advanced mode” queries:

  • where(result=SUCCESS)groupby(geoip_country_name, user, geoip_city)

  • groupby(result, geoip_country_name)

Depending on what you are trying to extract, you can simply use the copy button on the upper right portion of the second Table visual to copy the Group Column (and all entries) and the Count Column (and all it’s entries).