topic Re: Distance between two Geocoordinates in Splunk Search

Distance between two Geocoordinates

srs20 — Thu, 13 Jun 2019 22:53:33 GMT

I'm trying to find the distance between two geo coordinates and am looking for help with the search syntax.Here's what my data looks like
Index=S1 created from Sensor1.csv has Id,Lat1,Long1 and Index=S2 created from Sensor2.csv has Id,Lat2,Long2 . I need to find all Lat2 and Long2 that are within a certain distance (say 1 mile) of Lat1 and Long1. I'm ok to do something like the calculation below because I'm working in a small area and reasonable accuracy will work ..is the search syntax below correct?

index=S1 or index=S2 | eval distance=sqrt(pow(Lat1-Lat2,2)+pow(Long1-Long2,2)) ....

How would I use the Haversine formula (assuming I convert my lat long to the required x,y format that Haversine needs)

How do I use the calculated distance in my search syntax. Thanks

Re: Distance between two Geocoordinates

MuS — Thu, 13 Jun 2019 23:17:05 GMT

Hi srs20,

you can use this macro in macros.conf :

[distance(4)]
args = lat1,lon1,lat2,lon2
definition = eval rlat1 = pi()*$lat1$/180, rlat2=pi()*$lat2$/180, rlat = pi()*($lat2$-$lat1$)/180, rlon= pi()*($lon2$-$lon1$)/180\
| eval a = sin(rlat/2) * sin(rlat/2) + cos(rlat1) * cos(rlat2) * sin(rlon/2) * sin(rlon/2) \
| eval c = 2 * atan2(sqrt(a), sqrt(1-a)) \
| eval distance = 6371 * c |  fields - a c r*
iseval = 0

it can then be used in the SPL like this: | distance(lat1,lon1,lat2,lon2) (sorry not able to add the tick-thingy around the macro).

Hope this helps ...

cheers, MuS

Re: Distance between two Geocoordinates

woodcock — Thu, 13 Jun 2019 23:59:07 GMT

There are several apps for that:

https://splunkbase.splunk.com/apps/#/search/haversine/

Re: Distance between two Geocoordinates

srs20 — Fri, 14 Jun 2019 18:46:47 GMT

Thanks .Will try both options.