Geo Heatmap not showing data points on the map.

[srichansen]

Hi all,

I am having difficulty with geostats and the Geo heatmap visualization.

No matter what I input into the geostats command nothing is displayed on the map.
The same geostats results show up on all other mapping visualizations and display correctly.

Has anyone else had these issues?

thanks in advance,
Simon

This is a search example:

index="ndov_chb" source="meetboek_2017-07-26.csv" earliest=1 latest=now  

| eval y = RD_y, x = RD_x

| where y > 0 AND x > 0

| eval dX = round((('x' - 155000) *
0.00001),5), dY = round((('y' - 463000) * 0.00001),5)
| eval SomN = (3235.65389 * dY) + (-32.58297 * pow(dX,2)) + (-0.2475 * pow(dY,2)) + (-0.84978 * pow(dX,2) * dY) + (-0.0655
* pow(dY,3)) + (-0.01709 * pow(dX,2) * pow(dY,2)) + (-0.00738 * dX) + (0.0053
* pow(dX,4)) + (-0.00039 * pow(dX,2) * pow(dY,3)) + (0.00033 * pow(dX,4) * dY) + (-0.00012 * dX * dY), SomE = (5260.52916 * dX) + (105.94684 * dX * dY) + (2.45656 * dX * pow(dY,2)) + (-0.81885 * pow(dX,3)) + (0.05594 * dX
* pow(dY,3)) + (-0.05607 * pow(dX,3) * dY) + (0.01199 * dY) + (-0.00256 * pow(dX,3) * pow(dY,2)) + (0.00128 * dX
* pow(dY,4)) + (0.00022 * pow(dY,2)) + (-0.00022 * pow(dX,2)) + (0.00026 * pow(dX,5))

| eval latitude = 52.15517 + (SomN / 3600), longitude = 5.387206 + (SomE / 3600)

| where latitude<60 AND longitude < 8 AND latitude>0 AND longitude>0
| eval haltecodes = substr(Quaycode,6,len(Quaycode)-5)
| geostats latfield=latitude longfield=longitude count

here is an example of my geostats results:

geobin  latitude    longitude   count
bin_id_zl_0_y_6_x_4 52.17996    5.42564 46659
bin_id_zl_1_y_12_x_8    52.17996    5.42564 46659
bin_id_zl_2_y_25_x_16   52.17996    5.42564 46659
bin_id_zl_3_y_50_x_32   52.05388    4.82835 26785
bin_id_zl_3_y_50_x_33   52.34348    6.23268 19760
bin_id_zl_3_y_51_x_32   53.44860    5.62062 2
bin_id_zl_3_y_51_x_33   53.45916    5.88079 112
bin_id_zl_4_y_100_x_65  51.72564    4.75573 12924
bin_id_zl_4_y_100_x_66  51.48612    5.91255 6521

[djorkaef]

I believe this app is dead because it is indeed not showing anything in splunk 7.3

[dhirendra761]

This app will be helpful:
https://splunkbase.splunk.com/app/3124/

[Azeemering]

I think you need to do a count by field

For example | geostats latfield=latitude longfield=longitude count by geobin

[srichansen]

Hi Andre,

Thanks for the tip.

Unfortunately it does not seem to have any effect.

Using the cluster map or custom cluster map with the same results draws perfectly. Its only if you change it to the geo heatmap that nothing shows. What is strange is that if you zoom in you see the legend change based on the geobin it is using and the event count returned,

Its seems to me that the visualization is not rendering on the tiles. I am going to try clear out my browser and try some others and see if it gives the same problem.