topic Re: Cannot find any featureID in Geospatial Visualization. in Splunk Search

Cannot find any featureID in Geospatial Visualization.

sunrise — Tue, 29 Sep 2020 07:36:50 GMT

Hi Splunkers,

I tried the new feature, Geospatial Visualization in Splunk V6.3 as "Option 1" posted on splunk blog.
http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/

But I cannot find any featureID after I put tutorial data to splunk and configured Xpath as posted on blog.
KML file "cb_2014_us_cd114_500k.zip" is the same as posted in blog and splund.log said nothing about this.

Can anyone try tutorial data and get a featureID ?
Thank you for your help.

Re: Cannot find any featureID in Geospatial Visualization.

mporath_splunk — Tue, 13 Oct 2015 19:17:37 GMT

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

Re: Cannot find any featureID in Geospatial Visualization.

sunrise — Wed, 14 Oct 2015 01:34:59 GMT

Thank you very much, Michael.
I can get featureIds as values and the polygon as the following search.

source="/opt/tutorial/www1/*"  index="www"
| iplocation clientip | search Country="United States" | search City!=""
| lookup my_lookup longitude as lon, latitude as lat
| stats count by featureId
| geom my_lookup

Re: Cannot find any featureID in Geospatial Visualization.

jzapantis — Wed, 22 Mar 2017 15:31:22 GMT

The tutorial was very helpful. Can you explain why /Placemark/name wont work for the xpath?

I am assuming because it wont return a unique number, but it seems to be consistent among the census kml files I have been using.

Re: Cannot find any featureID in Geospatial Visualization.

myu_splunk — Tue, 29 Sep 2020 13:56:09 GMT

Hi jzapantis,

We've added some more information concerning XPath in the geospatial documentation here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuregeospatiallookups#Xpath_and_feature__id__element_example

In the example, it won't work because the KML path is different from the default feature_id_element.