topic Re: Custom cluster map complex issue- join command not giving results wanted in Splunk Search

Custom cluster map complex issue: Why is join command not giving results wanted?

jip31 — Tue, 08 Mar 2022 21:58:53 GMT

I use the search below in order to display markers on a map

As you can see, I use a join command in order to cross events by site between the lookup and the search

But the problem is that I have a difference between the marker displayed on the map and the reality

For example, If I do a focus on a specific site like MONTE CARLO, I have 10 events

But on the map, I just have 2 markers in this area with a count equal to 6 instead 10 even if I play with the zoom

so i understand nothing

Is it possible that this issue comes from the joind command?

If yes, is there another solution to improve my search?

thanks

ITWhisperer — Tue, 08 Mar 2022 18:45:54 GMT

Rather than join + inputlookup, try lookup

jip31 — Wed, 09 Mar 2022 05:29:21 GMT

perfect it's better without join!

but I have the same issue

I f I have a look for a specificic site like MONTE CARLO, you cans see that I found 11 events

so why in this area I found only 2 markers correso

ponding to 6 events instead 12?

ITWhisperer — Wed, 09 Mar 2022 07:19:41 GMT

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)

jip31 — Wed, 09 Mar 2022 07:24:37 GMT

it's better now, you are the best!