topic Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1? in Splunk Search

How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

jasongori — Mon, 12 Jan 2015 17:15:22 GMT

I have a geostats map in version 6.1 and I want to force it to NOT use clustering. I want to see an indicator for each of my locations and not have them grouped. Has anyone accomplished this or do you know how it can be done? Thank you.

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

Venkat_16 — Thu, 29 Jan 2015 10:21:25 GMT

You can avoid clustering by increasing the maximum number of clusters, below I have given maximum clusters as 999. You can increase the values further if you want. keep increasing the maximum cluster values until you get satisfactory result.But splunk recommends us to keep the value as "100" for maximum performance.

option name="mapping.data.maxClusters">900

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

slr — Tue, 16 Jun 2015 11:10:40 GMT

Hi there.

I have the same problem, but in 6.2.3. I tried the mapping.data.maxCluesters option, but I don't get any difference. I read the docs, but I don't find answers. Any suggestions?

Regards.

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

slr — Thu, 18 Jun 2015 14:12:36 GMT

I guess that the "problem" is relative to the maximum zoom level used by geostats. The levels are between 0 and 9. If I use opestreetmaps I get more zoom levels, but geostats represent the data always with the basic zoom levels (0-9). If geostats choose that in level 9 two or more locations will be together, I can't say "don't do it" even if I use the option name="mapping.data.maxClusters" in xml.

Well... any suggestions, please?

Regards.

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

jreynolds20 — Wed, 15 Jul 2015 19:52:34 GMT

I am running into this same problem, in that I am trying to plot points on a map, but even though OpenStreetMaps allows me to zoom down to the building level, my points plotted over the span of a few blocks always wind up being aggregated together. Any ideas on how to fix this?

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

jcrabb_splunk — Thu, 23 Jul 2015 15:26:12 GMT

I would recommend trying the optional geostats argument maxzoomlevel :

http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Geostats#Optional_arguments

As an example: index=example | geostats maxzoomlevel=15 count by host .

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

slr — Thu, 23 Jul 2015 15:41:39 GMT

THANK YOU.

I read before the maxzoomlevel argument, but I never used it because I understood that was like the tile > maxzoomlevel option of the GUI. I tried right now, and it worked.

For me, this is the answer that I wanted.

Thank you again.

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

Venkat_16 — Mon, 17 Aug 2015 07:45:57 GMT

The temporary solution was to reduce the cluster size so that the clusters don't merge and also fixing the minimum and maximum zoom levels. I have limited locations on the map so i used the temporary solution. Below are the options which i played around.

  option name="charting.chart.bubbleMaximumSize" 50 /option
    option name="charting.chart.bubbleMinimumSize" 10 /option

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

eddieyugo — Tue, 27 Sep 2016 23:56:02 GMT

Thank you!! This works perfectly now 🙂

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

woodcock — Thu, 14 Nov 2019 22:40:56 GMT

The accepted answer only fences the zoom, the way to do what was actually asked is like this:

... | geostats binspanlat=1 binspanlong=1 ....

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

woodcock — Thu, 14 Nov 2019 22:41:48 GMT

See my unaccepted answer below for the correct setting to use for this.

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

mcg_connor — Fri, 22 Nov 2019 18:16:28 GMT

Thanks this works better for me than the previous answer!

Re: How to disable location clustering of results on a map generated by the geostats command in Splunk 6.1?

woodcock — Fri, 22 Nov 2019 18:32:10 GMT

You might consider switching the Accepted answer so that other people will get the best answer.