<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Geostats Mapping in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Geostats-Mapping/m-p/447629#M55053</link>
    <description>&lt;P&gt;I have a json array of movement data coming in with multiple lat and long values and am having difficulty plotting this movement on a map.&lt;/P&gt;

&lt;P&gt;I am able to get these to plot as a single point when I have only one lat/long combination in the event, however when there are multiples as in the below example (in &lt;CODE&gt;markers{}&lt;/CODE&gt;), I lose the visualization.&lt;/P&gt;

&lt;P&gt;Incoming data example:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;{   
     date_start:     1531698100.179007  
     date_update:    1531698291.081359  
     markers:   [
        {
         date:   1531698136.120904  
         latitude:   27.411273  
         longitude:  -82.505357     
        }   
        {
         date:   1531698140.102953  
         latitude:   27.411935  
         longitude:  -82.505325 
        }   
    ]   
     total_distance_in_meters:   2470   
     total_time_minutes:     2.5999695122241966 
    ]   
}
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I am using the below.  The &lt;CODE&gt;mvexpand&lt;/CODE&gt; breaks the single event into 2 based on the &lt;CODE&gt;date&lt;/CODE&gt; creates 2 separate events, which I believe is what I need to do however they just don't plot:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index="myindex" source="mysource.json" 
| mvexpand markers{}.date
| geostats latfield=markers{}.latitude longfield=markers{}.longitude count
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Where am I going wrong here?&lt;/P&gt;</description>
    <pubDate>Wed, 18 Jul 2018 17:43:52 GMT</pubDate>
    <dc:creator>leonards1</dc:creator>
    <dc:date>2018-07-18T17:43:52Z</dc:date>
    <item>
      <title>Geostats Mapping</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Geostats-Mapping/m-p/447629#M55053</link>
      <description>&lt;P&gt;I have a json array of movement data coming in with multiple lat and long values and am having difficulty plotting this movement on a map.&lt;/P&gt;

&lt;P&gt;I am able to get these to plot as a single point when I have only one lat/long combination in the event, however when there are multiples as in the below example (in &lt;CODE&gt;markers{}&lt;/CODE&gt;), I lose the visualization.&lt;/P&gt;

&lt;P&gt;Incoming data example:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;{   
     date_start:     1531698100.179007  
     date_update:    1531698291.081359  
     markers:   [
        {
         date:   1531698136.120904  
         latitude:   27.411273  
         longitude:  -82.505357     
        }   
        {
         date:   1531698140.102953  
         latitude:   27.411935  
         longitude:  -82.505325 
        }   
    ]   
     total_distance_in_meters:   2470   
     total_time_minutes:     2.5999695122241966 
    ]   
}
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I am using the below.  The &lt;CODE&gt;mvexpand&lt;/CODE&gt; breaks the single event into 2 based on the &lt;CODE&gt;date&lt;/CODE&gt; creates 2 separate events, which I believe is what I need to do however they just don't plot:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index="myindex" source="mysource.json" 
| mvexpand markers{}.date
| geostats latfield=markers{}.latitude longfield=markers{}.longitude count
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Where am I going wrong here?&lt;/P&gt;</description>
      <pubDate>Wed, 18 Jul 2018 17:43:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Geostats-Mapping/m-p/447629#M55053</guid>
      <dc:creator>leonards1</dc:creator>
      <dc:date>2018-07-18T17:43:52Z</dc:date>
    </item>
  </channel>
</rss>

