topic Re: Geostats by phone number in Splunk Search

Geostats by phone number

indeed_2000 — Mon, 11 Oct 2021 20:07:28 GMT

I have field in my log that call “MobileNumber” that need to show count of MobileNumber by location on map.

e.g: 00121234567

Area code:0012

Number:1234567

if area code belong to Berlin 0151, 0157 or 0173. show total count of area code that belong Berlin on map.

if area code belong to Wolfsburg 0361 show total count of area code that belong Wolfsburg on map

FYI: Latitude, Longitude not exist in log file.

Any idea?

Thanks

Re: Geostats by phone number

Azeemering — Mon, 11 Oct 2021 20:32:26 GMT

This is not the full solution, but you could eval the longitude and latitude for each result.
Or use a lookup with all cities lon and lats.

Basic example

| makeresults
| eval City = "Berlin" |eval lat="52.520008" | eval lon="13.404954"
| geostats latfield=lat longfield=lon count

Re: Geostats by phone number

indeed_2000 — Mon, 11 Oct 2021 20:37:18 GMT

And how bind it to area code?

Re: Geostats by phone number

Azeemering — Mon, 11 Oct 2021 20:46:14 GMT

I'd say create a lookup with area codes and their respective longitudes and latitudes.
Splunk can do magic, but you need to feed it some ingredients to do magic with.

I found this as a possible source:

https://gist.github.com/iteufel/af379872bbc3bf5261e2fd09b681ff7e

Re: Geostats by phone number

indeed_2000 — Mon, 11 Oct 2021 20:54:59 GMT

thank you for answer, but it's not only germany.

about lookup would please tell me example?

Re: Geostats by phone number

Azeemering — Mon, 11 Oct 2021 20:56:56 GMT

https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Aboutlookupsandfieldactions

Re: Geostats by phone number

indeed_2000 — Mon, 11 Oct 2021 21:23:55 GMT

thank you, i work with lookup, and example map dasboard.

the main goal is how can i provide relation between these items.