topic Using GeoStats to point locations based on eval values in Splunk Search

Using GeoStats to point locations based on eval values

richaGindodia — Fri, 13 Mar 2015 06:41:08 GMT

My UseCase

I am using splunk to monitor a file which has latitude, longitude and CPUUsage values . I want splunk to highlight the point where CPUUsage is >75 . I tried using

index=* | geostats latfield=Latitude longfield=Longitude count | eval redCount = if(CPUUsage >75,CPUUsage,0) | eval yellowCount = if(CPUUsage <75,CPUUsage,0) |fields - CPUUsage
Then using fieldcolours

but in vain. Please Help.

Re: Using GeoStats to point locations based on eval values

richaGindodia — Mon, 23 Mar 2015 10:30:22 GMT

I was able to find an answer to this. Achieved it using rangemap

| rangemap field=CPU Good=0-30 Fair=30-40 Bad=40-100 | geostats latfield=Latitude longfield=Longitude count by range
{Good:0x008000,Fair:0xFFFF00,Bad:0xFF0000}

Re: Using GeoStats to point locations based on eval values

chimell — Mon, 23 Mar 2015 13:25:18 GMT

Hi richaGindodia

1- Use the following search code for splunk 6.2.x

index=* |where CPUUsage >75 |geostats latfield=Latitude longfield=Longitude count by CPUUsage

In visualisation tab go to chart type and select map.

2- Use the following simple xml code for splunk 6.1.x

<dashboard>
  <label>enter your dashboard name</label>
  <row>
    <panel>
      <map>
        <searchString>
         index=* |where CPUUsage >75 |geostats  globallimit=0 latfield=Latitude longfield=Longitude count by CPUUsage
          <earliest>0</earliest>
          <latest>now</latest>
        </searchString>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.drilldown">all</option>
        <option name="mapping.map.center">(0,0)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.tileLayer.maxZoom">7</option>
        <option name="mapping.tileLayer.minZoom">0</option>
      </map>
    </panel>
  </row>
</dashboard>

Re: Using GeoStats to point locations based on eval values

richaGindodia — Fri, 27 Mar 2015 06:23:50 GMT

Hello Chimell,

Thank you for a response. But this doesnot serve my purpose. Though it highlights the lat-long combinations where CPU>75 but in process it removes all those wherein CPU<75. I wanted CPU>75 in RED, CPU<75 in GREEN and CPU=0 in GREY.

I think the question I posted was a bit confusing 😞 . Hope this clears the use-case.