topic Re: Splunk Maps in Splunk Search

Splunk Maps

alaaelbahrawy — Sun, 26 May 2019 07:43:08 GMT

what is the difference between cluster and cheograph maps in splunk?
and can i use cluster maps with coordinates not lat and long

Re: Splunk Maps

koshyk — Sun, 26 May 2019 09:16:37 GMT

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

Re: Splunk Maps

alaaelbahrawy — Mon, 27 May 2019 11:49:18 GMT

thanks for answering,i tries yes to change the coordinates to long and lat but i wanted it in the first place for the following case
I want the map to appear more than 1 value. like
total, subtotal
100,30
50,20

So that it can be for each country the number of total and subtotal. Can the cluster map help in this case?

Re: Splunk Maps

DavidHourani — Mon, 27 May 2019 12:00:34 GMT

Hi @alaaelbahrawy,

In the link below you can find the options for the cluster-map :

https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/MarkerMap

As you can see it leverages geostatsto build the visualization which means you're limited to the number of parameters geostats takes which is this case is only one field, either total or subtotal : https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

Cheers,
David

Re: Splunk Maps

koshyk — Mon, 27 May 2019 14:05:26 GMT

cluster map uses geostats and normally it is aggregated for one value at a time.
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

Re: Splunk Maps

alaaelbahrawy — Tue, 28 May 2019 07:38:17 GMT

okaay i get it now. So can choropleth maps also use 2 values or 1 also? or is there any other way to do so using the maps.

Re: Splunk Maps

alaaelbahrawy — Tue, 28 May 2019 07:40:02 GMT

okay good. is there is any other way to draw 2 values in splunk maps?

Re: Splunk Maps

DavidHourani — Tue, 28 May 2019 07:44:08 GMT

One value at a time 😉 try looking for custom visualizations maybe something can add 2 values instead ?

Re: Splunk Maps

alaaelbahrawy — Tue, 28 May 2019 07:47:19 GMT

okay thanks for answering 😄