Hi all,
I am having difficulty with geostats and the Geo heatmap visualization.
No matter what I input into the geostats command nothing is displayed on the map.
The same geostats results show up on all other mapping visualizations and display correctly.
Has anyone else had these issues?
thanks in advance,
Simon
This is a search example:
index="ndov_chb" source="meetboek_2017-07-26.csv" earliest=1 latest=now
| eval y = RD_y, x = RD_x
| where y > 0 AND x > 0
| eval dX = round((('x' - 155000) *
0.00001),5), dY = round((('y' - 463000) * 0.00001),5)
| eval SomN = (3235.65389 * dY) + (-32.58297 * pow(dX,2)) + (-0.2475 * pow(dY,2)) + (-0.84978 * pow(dX,2) * dY) + (-0.0655
* pow(dY,3)) + (-0.01709 * pow(dX,2) * pow(dY,2)) + (-0.00738 * dX) + (0.0053
* pow(dX,4)) + (-0.00039 * pow(dX,2) * pow(dY,3)) + (0.00033 * pow(dX,4) * dY) + (-0.00012 * dX * dY), SomE = (5260.52916 * dX) + (105.94684 * dX * dY) + (2.45656 * dX * pow(dY,2)) + (-0.81885 * pow(dX,3)) + (0.05594 * dX
* pow(dY,3)) + (-0.05607 * pow(dX,3) * dY) + (0.01199 * dY) + (-0.00256 * pow(dX,3) * pow(dY,2)) + (0.00128 * dX
* pow(dY,4)) + (0.00022 * pow(dY,2)) + (-0.00022 * pow(dX,2)) + (0.00026 * pow(dX,5))
| eval latitude = 52.15517 + (SomN / 3600), longitude = 5.387206 + (SomE / 3600)
| where latitude<60 AND longitude < 8 AND latitude>0 AND longitude>0
| eval haltecodes = substr(Quaycode,6,len(Quaycode)-5)
| geostats latfield=latitude longfield=longitude count
here is an example of my geostats results:
geobin latitude longitude count
bin_id_zl_0_y_6_x_4 52.17996 5.42564 46659
bin_id_zl_1_y_12_x_8 52.17996 5.42564 46659
bin_id_zl_2_y_25_x_16 52.17996 5.42564 46659
bin_id_zl_3_y_50_x_32 52.05388 4.82835 26785
bin_id_zl_3_y_50_x_33 52.34348 6.23268 19760
bin_id_zl_3_y_51_x_32 53.44860 5.62062 2
bin_id_zl_3_y_51_x_33 53.45916 5.88079 112
bin_id_zl_4_y_100_x_65 51.72564 4.75573 12924
bin_id_zl_4_y_100_x_66 51.48612 5.91255 6521
I believe this app is dead because it is indeed not showing anything in splunk 7.3
This app will be helpful:
https://splunkbase.splunk.com/app/3124/
I think you need to do a count by field
For example | geostats latfield=latitude longfield=longitude count by geobin
Hi Andre,
Thanks for the tip.
Unfortunately it does not seem to have any effect.
Using the cluster map or custom cluster map with the same results draws perfectly. Its only if you change it to the geo heatmap that nothing shows. What is strange is that if you zoom in you see the legend change based on the geobin it is using and the event count returned,
Its seems to me that the visualization is not rendering on the tiles. I am going to try clear out my browser and try some others and see if it gives the same problem.