<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to create a map (geostats)  with multiple fields/count by ? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-map-geostats-with-multiple-fields-count-by/m-p/520289#M34977</link>
    <description>&lt;P&gt;may be you can try something like below: grouped is new field show value like Country-City and calculated field is used in by clause of geostats&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval ip="129.10.32.10"
| iplocation ip
| eval grouped=Country+"-"+City
| geostats count by grouped&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 18 Sep 2020 09:20:15 GMT</pubDate>
    <dc:creator>thambisetty</dc:creator>
    <dc:date>2020-09-18T09:20:15Z</dc:date>
    <item>
      <title>How to create a map (geostats)  with multiple fields/count by ?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-map-geostats-with-multiple-fields-count-by/m-p/520286#M34976</link>
      <description>&lt;P&gt;Hello everyone, I'm a new in your community, thank you for the welcome &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;BR /&gt;&lt;BR /&gt;I need to display a map with several fields for each data.&lt;BR /&gt;I had done this for display with a single data (it works!)&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| inputlookup  data.csv  
| search agence_rattachement="*" AND code_client_groupe=* AND nom_site=* AND id_departement=* 
| lookup villes_france.csv nom_reel AS ville_site OUTPUTNEW longitude_dgr,latitude_dgr
| lookup data-2.csv nom_site_rattachement AS  nom_site  OUTPUTNEW nombre_compresseur, numero_centrale
| geostats latfield=latitude_dgr longfield=longitude_dgr count by nom_site&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;But with a multitude of fields, it no longer works:/&lt;/P&gt;&lt;P&gt;I have the data (see in picture) but the map contains no points:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| inputlookup  data.csv  
| search agence_rattachement="*" AND code_client_groupe=* AND nom_site=* AND id_departement=* 
| lookup villes_france.csv nom_reel AS ville_site OUTPUTNEW longitude_dgr,latitude_dgr
| lookup data_2.csv nom_site_rattachement AS  nom_site  OUTPUTNEW nombre_compresseur, numero_centrale
| geostats latfield=latitude_dgr longfield=longitude_dgr translatetoxy=false count by nom_site&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thx you !!!! Have a good day&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture.PNG" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/10881i6D62A345F91BBDA7/image-size/large?v=v2&amp;amp;px=999" role="button" title="Capture.PNG" alt="Capture.PNG" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;Capture.PNG&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 18 Sep 2020 15:15:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-map-geostats-with-multiple-fields-count-by/m-p/520286#M34976</guid>
      <dc:creator>Fadom1013</dc:creator>
      <dc:date>2020-09-18T15:15:42Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a map (geostats)  with multiple fields/count by ?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-map-geostats-with-multiple-fields-count-by/m-p/520289#M34977</link>
      <description>&lt;P&gt;may be you can try something like below: grouped is new field show value like Country-City and calculated field is used in by clause of geostats&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults | eval ip="129.10.32.10"
| iplocation ip
| eval grouped=Country+"-"+City
| geostats count by grouped&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 18 Sep 2020 09:20:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-map-geostats-with-multiple-fields-count-by/m-p/520289#M34977</guid>
      <dc:creator>thambisetty</dc:creator>
      <dc:date>2020-09-18T09:20:15Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a map (geostats)  with multiple fields/count by ?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-map-geostats-with-multiple-fields-count-by/m-p/520296#M34981</link>
      <description>&lt;P&gt;Thx ! i do :&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval grouped = name + "_" + nb + "_" + id
| geostats latfield=latitude_dgr longfield=longitude_dgr  count by grouped&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;It's &lt;SPAN&gt;concatenate&lt;/SPAN&gt;every fields in one field, is good, when i am on a point of a map i have : name_number_id (he 3 fields &lt;SPAN&gt;concatenate&lt;/SPAN&gt;), is good thanks !&lt;BR /&gt;&lt;BR /&gt;But for the link target of the drilldown of the map i need to split it &lt;span class="lia-unicode-emoji" title=":confused_face:"&gt;😕&lt;/span&gt; You known how ? &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Because :&amp;nbsp;&lt;BR /&gt;&amp;lt;link target="_blank"&amp;gt;/form?token=$click.name$&amp;lt;/link&amp;gt; and i just nedd the name_ of the value click name (not name_nb_id)&lt;/P&gt;</description>
      <pubDate>Fri, 18 Sep 2020 10:08:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-map-geostats-with-multiple-fields-count-by/m-p/520296#M34981</guid>
      <dc:creator>Fadom1013</dc:creator>
      <dc:date>2020-09-18T10:08:39Z</dc:date>
    </item>
  </channel>
</rss>

