I have a list of cities from this open source https://www.maxmind.com/en/free-world-cities-database link. In my data, i have the names of cities for each event and I, therefore, want to create a map when a city is mentioned so i can see how many of X events per city and create a world map.
I have uploaded this txt file and saved it in a lookup table in Splunk as a .csv and i am wondering does anyone know how to do the rest?
I have an idea but a help would be great thanks.
here is some documentation to follow. https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/MarkerMap
in your csv, based on the data from maxmind, you should have the latitude and longitude.
basesearch|geostats latfield=latitude longfield=longitude count
Thank you @cmerriman
I will look into this. Turns out i am being to detailed and all i really need to do is create a csv and then use a search to cross reference this csv which has about 20 rows like the following example
office code office country Lattitude Longitude
US-CA California US 36.778261 -119.4179324
So if i wanted to create a cluster map from data that has the office code, have you suggestions how I would do this? I know its using lookup& possibly geostats but i am unsure how to build the map from something that is not an IP address.
thanks so much
if your data has the office code, you can join it to your csv with something like this:
index=office_code_data |table office_code other_interesting_fields |join office_code [|inputlookup office_code.csv] |geostats latfield=latitude longfield=longitude count