topic Re: How do I display negative values through geostats? in Splunk Search

How do I display negative values through geostats?

andrewtrobec — Sat, 26 Nov 2016 17:28:22 GMT

Hello,

I'm busy mapping temperatures for locations around the world and in some cases the value is negative. Unfortunately negative values are not displayed in the map through the geostats command, so I was wondering how to enable them? I've tried setting the marker sizes so that it is the same for all values:

<option name="mapping.markerLayer.markerMaxSize">10</option>
<option name="mapping.markerLayer.markerMinSize">10</option>

But this only makes positive values the same size, negative values are still missing...

Any ideas?

Thank you!

Andrew

Re: How do I display negative values through geostats?

martin_mueller — Sat, 26 Nov 2016 19:36:25 GMT

Maybe it's just me, but I cannot picture a pie slice or marker with a negative-sized area.

KelvinFTW

Re: How do I display negative values through geostats?

andrewtrobec — Sat, 26 Nov 2016 23:28:39 GMT

I know what you mean, but I don't want the marker to expand or contract based on the value being displayed. I want it to be a constant size despite being a positive or negative value.

Re: How do I display negative values through geostats?

martin_mueller — Sun, 27 Nov 2016 00:01:31 GMT

The marker is a pie chart of your various temperature categories, with the temperature used as the size of that category's slice. If you have a negative temperature, you're drawing a pie slice of negative size.

Zoom way out, to let two markers merge into one - you should see the pie.

Re: How do I display negative values through geostats?

martin_mueller — Sun, 27 Nov 2016 00:04:30 GMT

Try this:

base search | eval category = case(TEMP < 0, "freezing", TEMP < 15, "cold", TEMP < 25, "temperate", TEMP < 35, "hot", true(), "boiling")
| geostats latfield=LAT longfield=LON count by category

Re: How do I display negative values through geostats?

andrewtrobec — Sun, 27 Nov 2016 00:12:42 GMT

Hey Martin,

This makes it visible since it's a count (a positive value) and not the temperature (negative value). I'd like to have the marker so that when I put by cursor on it, it shows the temperature and not the count.

Is this possible you think?

Re: How do I display negative values through geostats?

martin_mueller — Sun, 27 Nov 2016 00:15:08 GMT

You could round to whole degrees, and do a count by TEMP... then colour all reasonable values accordingly.

As long as the negative temperature is considered a value and not a split-by field, this visualization will attempt to draw a pie slice of negative area. Geometry doesn't do that.

Re: How do I display negative values through geostats?

andrewtrobec — Sun, 27 Nov 2016 11:08:33 GMT

I'm not sure what you mean by "round to whole degrees. and do a count by TEMP" . Wouldn't this still make every value 1?

Re: How do I display negative values through geostats?

martin_mueller — Sun, 27 Nov 2016 13:24:04 GMT

That would make the value the number of cities underneath the marker with that temperature, and would make the label the temperature.

Re: How do I display negative values through geostats?

andrewtrobec — Sun, 27 Nov 2016 21:34:03 GMT

This is great! The negative value now appears, thank you so much! I can't make this comment the answer... is there a way for you to move it to be an answer?