Custom Cluster Map & Geo Heatmap Custom Visualization: How to make these map apps work on Splunk?

[DavidLago]

I have installed some apps, including Custom Cluster Map Visualization and Geo Heatmap Custom Visualization, but there is little or no information about them in the internet, also the app do not provide a help file or anything like it.

I'm stuck, I have no idea how to make that work.

So far I've listed the cities I want to be shown in red on the map (in case a specific value crosses a threshold), I have all the Lat and Long for each of them, but nothing that I test show any results. For example:

earliest=-15m object="Processor" counter="% Processor Time" sourcetype=CPU | where Value>90 | table host Value | geostats latfield=25.204849 longfield=55.270783 avg(count)

How do I get started here?

[ziegfried]

geostats expects field names for latfield/longfield instead of values. Otherwise your search looks reasonable. Try this instead:

 earliest=-15m object="Processor" counter="% Processor Time" sourcetype=CPU | where Value>90 | table host Value | eval lat=25.204849 | eval long=55.270783 | geostats latfield=lat longfield=long avg(count)