topic Re: Why do my location lookups consolidate to one lat/long event on my heat map? in Dashboards & Visualizations

Why do my location lookups consolidate to one lat/long event on my heat map?

ajobling1964 — Tue, 29 Aug 2017 10:10:44 GMT

I have a dataset of events around a particular city which I wish to represent on a heat map. I have a lookup to each latitude and longitude, but when I try and produce a map it seems to combine all the events into 1 lat and long location.
How can I drill down further?

my search code looks like

index=edisyslogdata exEventType="Area Change" streetName!=NULL | lookup EdiStreetAssets StreetAsset as apId | table apId, streetName, lat, long | geostats latfield=lat longfield=long count BY apId

Re: Why do my location lookups consolidate to one lat/long event on my heat map?

niketn — Tue, 29 Aug 2017 11:55:03 GMT

@ajobling1964, you can use mapping.map.zoom and mapping.map.center to set initial location/zoom for the visualization on loading. You can use scroll to zoom in and zoom out(provided scroll zoom is enabled through Edit > Format option) or else through mapping.map.scrollZoom

Chech out Splunk documentation for Map Simple XML configuration reference: http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map

Re: Why do my location lookups consolidate to one lat/long event on my heat map?

ab81428 — Fri, 01 Sep 2017 11:26:54 GMT

I hope its because of restriction no of Clusters
By default It will be 100, change it to 10000 or 100000 & check it.

It's works for me,

In Source XML:

option name="mapping.data.maxClusters">100000/option>

Re: Why do my location lookups consolidate to one lat/long event on my heat map?

ab81428 — Mon, 04 Sep 2017 06:30:38 GMT

@ajobling1964 - did you get a chance to check with above option..

Re: Why do my location lookups consolidate to one lat/long event on my heat map?

ajobling1964 — Thu, 07 Sep 2017 10:05:11 GMT

thanks - I have experimented with various combinations of cluster and binspanlat and binspanlong settings. The latest results in my clusters appear momentarily and then disappearing!
I guess what I'm really after is decent documentation and examples of code for heat maps (over a time period) and cluster maps.

Re: Why do my location lookups consolidate to one lat/long event on my heat map?

niketn — Thu, 07 Sep 2017 10:39:04 GMT

@ajobling1964, are you using built in map or some other custom visualization app which plot map?

Re: Why do my location lookups consolidate to one lat/long event on my heat map?

ajobling1964 — Fri, 08 Sep 2017 07:55:31 GMT

It's the open street map which is one of the preset configurations on the Tiles tab.

Re: Why do my location lookups consolidate to one lat/long event on my heat map?

dhirendra761 — Tue, 04 Dec 2018 09:06:28 GMT

Your dataset of events are too near to each other . Try to use below. This app will be helpful:
https://splunkbase.splunk.com/app/3124/