topic How to create a map in dashboard panel from pivot zip code data? in Dashboards & Visualizations

How to create a map in dashboard panel from pivot zip code data?

dhavamanis — Mon, 28 Sep 2020 17:23:19 GMT

In pivot we have data like below. Can you please help us to generate the MAP chart (USA geographical location) in dashboard panel. Once after assigning this value to dashboard panel and trying to convert into MAP, nothing is showing. Please provide the necessary details to build a Map with this data. Basically we are trying to show the MAP based on location zipcode and number of users accessing the site.

Primary_Address_zip Count

07607 1201

10101 105000

10036 2000

Can you please help us for this plotting the map.

Re: How to create a map in dashboard panel from pivot zip code data?

ChrisG — Fri, 29 Aug 2014 19:16:09 GMT

You would have to do it with a lookup table that enriches the ZIP codes with their geographical data , see this previous Splunk Answers posting for pointers.

Re: How to create a map in dashboard panel from pivot zip code data?

dhavamanis — Mon, 28 Sep 2020 17:28:37 GMT

Thanks, I am trying to build the MAP with the below query, i could see some results in the statistics view but its nothing showing in Map (zip, Lat and Long). Can you please review this query and correct me if anything wrong.

index="abcindex" | stats sum(Primary_Address_ZIP) as _geo_count by Primary_Address_ZIP | lookup geolookup Zipcode as Primary_Address_ZIP OUTPUT Lat, Long | where Lat not null AND Long not null | eval _geo=Lat+","+Long

Re: How to create a map in dashboard panel from pivot zip code data?

hsesterhenn — Tue, 11 Nov 2014 11:11:35 GMT

Hi,

I don't know whether this is a typo:

You need 'lat' and 'lon' fields to use a map.

If you use the 'geostats' command you can set the field name with 'geostats latfield=Lat longfield=Long ...'.

With 'iplocation ip_fieldname' you get 'lat' and 'lon'.

Just small differences but they count 🙂

HTH,

Holger

Re: How to create a map in dashboard panel from pivot zip code data?

dhavamanis — Mon, 28 Sep 2020 18:25:07 GMT

Thanks. The below geostats command works fine.

index=abcindex | lookup geolookup "Primary Address_ZIP" as "Primary Address_ZIP" OUTPUT latitude , longitude |geostats latfield=latitude longfield=longitude count by "Primary Address_ZIP"