topic Question about geostats in Splunk Search

Question about geostats

yan — Wed, 10 Mar 2021 02:12:38 GMT

Hello, I am new to SPL language. I have been working on 'geostats' recently and not quite sure what 'translatetoxy' or 'locallimit' are used for. Can anybody make clear how those parameters are used?

Many Thanks!

Re: Question about geostats

richgalloway — Wed, 10 Mar 2021 14:38:44 GMT

Any time you find something confusing or unclear in Splunk documentation you should submit feedback on that page. The Docs team is very good about improving documentation in response to user feedback.

As I understand it, the locallimit option controls how many items of each series will be returned. For example, if you used

| geostats locallimit=5 ... by Country

then each country would show 5 entries.

I don't understand the translatetoxy option, but if you want to display results on a map then the option must be set to true.

Re: Question about geostats

yan — Thu, 11 Mar 2021 05:29:03 GMT

Thanks for the quick response. I gave a thumbs-up 😁. However I couldn't see any difference from my data so I still feel confused. Could you please post maybe 2 pics that illustrates the differences with different locallimt value?

Thanks again!

Re: Question about geostats

richgalloway — Thu, 11 Mar 2021 14:12:50 GMT

Sorry, but I have no examples of the geostats command.