Hello everybody,
I need help to create a multi metric job.
The idea is that I want to detect users that connect from different countries, for example if a user used to connect from Germany, if one day he connects from France, I will receive an alert.
I tried to create the job like that:
metric: Distinct count(source.geo.country_code2.keyword)
and Distinct count(source.nat.geo.country_code2.keyword)
split field: user.name
The result I got are like below, which is not the result that I want as it's not responding to my need
Could you please tell me how can I create this job.
Best regards