topic Re: Plot data from TCP to Google Maps in Getting Data In

Plot data from TCP to Google Maps

streddy — Sun, 03 Mar 2013 05:00:44 GMT

Hi,

I am interested in plotting marine data from:

http://www.marinetraffic.com/ais/exportraw.aspx?id=1234567890&protocol=xml&msgtype=extended&timespan=10

onto the google Maps app in Splunk as an example.

I'd like to know how to point Splunk at the right address.

Re: Plot data from TCP to Google Maps

lguinn2 — Sun, 03 Mar 2013 06:13:18 GMT

It appears that your data will have fields named LAT and LON. Try this:

sourcetype=shipdata moresearchstuff
| eval _geo = tostring(LAT) + "," + tostring(LON)

This will create the _geo field that the app expects.

To get the data into Splunk, you have many choices. You could set up a feed as they describe in the web page. Or you could use the data export function to retrieve the data into a file. Once you have the data in a file, you could upload it into Splunk using the Manager and Data Inputs. It will be easiest if you have already created a sourcetype for your data. You could put the following lines in $SPLUNK_HOME/etc/system/local/props.conf

[shipdata]
BREAK_ONLY_BEFORE=\<row
TIME_PREFIX=TIMESTAMP\=\"
MAX_TIMESTAMP_LOOKAHEAD=30
TIME_FORMAT=%Y-%m-%dT%H:%M:%S

The fields will be extracted for you automatically. If you need more help than this, may I suggest the Getting Data In manual...

Re: Plot data from TCP to Google Maps

streddy — Sun, 03 Mar 2013 07:31:12 GMT

But how do I get splunk to index the data in the first place?

Re: Plot data from TCP to Google Maps

streddy — Sun, 03 Mar 2013 11:36:26 GMT

Thank you so much!!!