topic Re: Best way to import geolocations info and use it in maps? in Getting Data In

Best way to import geolocations info and use it in maps?

arkadyz1 — Fri, 13 Mar 2015 17:34:21 GMT

I'm curious whether there is a preferred way of getting the geolocation data in and using it in the searches. We are talking about a company which has many (several dozen) different branches all over the country. The list of those branches will change every now and then, but it will be a rare event.

Right now, just for the sake of getting something working, I created a CSV file of branches containing their longitude and latitude, imported it once and created a couple of maps with underlying searches joining the resulting list of "events" on the location ID before going into 'geostats' command. However, I have a feeling that JOIN is a cumbersome way of doing it. Is there anything better suited for the task?

Re: Best way to import geolocations info and use it in maps?

martin_mueller — Sat, 14 Mar 2015 00:24:38 GMT

For mostly static data the most common approach is to put it into a CSV file and upload that as a lookup file. Using that, you can either use that data to enrich events in Splunk indexes with geolocation data, or use the file itself (| inputlookup file.csv) to draw a map of all branches without any current events from those branches.

A little documentation on lookups: http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Aboutlookupsandfieldactions

Re: Best way to import geolocations info and use it in maps?

arkadyz1 — Mon, 23 Mar 2015 19:26:22 GMT

That fully satisfies it. I tried uploading my file and then using LOOKUP command and it worked perfectly. My only remaining question would be "How to modify the CSV file I'm using". For example, when the company opens a new branch, we would want to add it to that CSV file. Is it as easy as uploading its modified version under the same name?

Re: Best way to import geolocations info and use it in maps?

martin_mueller — Wed, 25 Mar 2015 23:30:02 GMT

You can either drop a replaced file onto the server itself, or upload a new file through the UI, You might need to first delete the file from the UI though.