topic Re: Geostats display custom column in Dashboards & Visualizations

Geostats display custom column

rsokolova — Wed, 30 Sep 2020 00:22:50 GMT

Thanks in advance. I'm struggling trying to display the amount of requests per zip code however its just showing the amount of zip codes.

Search:
index=soa source="export.csv" host="misssplunksh01.corp.rndc-usa.com" index="soa" sourcetype="csv"
| geostats latfield=GEO_LAT longfield=GEO_LONG sum(TOTAL_SALES) by Zip

How the data looks like:

How the map looks like.

Please let me know if something is unclear , thanks again

Re: Geostats display custom column

MuS — Tue, 07 May 2019 20:22:19 GMT

Please add the SPL you used to create the table/map.

cheers, MuS

Re: Geostats display custom column

rsokolova — Tue, 07 May 2019 20:55:43 GMT

Thanks for helping @MuS , I've added the search to the main post.... Also tried using count , without by clause and using other app which is called maps for splunk but no luck so far.

Re: Geostats display custom column

MuS — Tue, 07 May 2019 21:16:54 GMT

Have you tried:

| geostats latfield=GEO_LAT longfield=GEO_LONG count(request_field_name) AS requests by Zip

Re: Geostats display custom column

rsokolova — Wed, 08 May 2019 00:47:33 GMT

@MuS , just tried but didn't work.

Re: Geostats display custom column

MuS — Wed, 08 May 2019 03:11:33 GMT

Can you please add some anonymised event samples?

Re: Geostats display custom column

quantum_view — Wed, 08 May 2019 04:08:33 GMT

Try;
|stats values(TOTAL_SALES) as "Total Sales" by Zip
Sum grabs the total of all field values while stats values grabs the each key of each value and outputs them. Let me know the news pls.

Re: Geostats display custom column

woodcock — Sat, 06 Jul 2019 22:22:50 GMT

Check out the geo-based examples in the Splunk Dashboard Examples app:
https://splunkbase.splunk.com/app/1603/