All Apps and Add-ons

How to edit my search to count number of shipments and display shipment count on a map visualization?

rmanghat
New Member

My requirement is to summarize the number of shipments to all zip codes for a particular day and plot the shipment count by the corresponding zip code in a Clustered Single Value Map Visualization or any map in Splunk. I used the following search but it seems to be summarizing by the total number of Zip codes instead of the total shipments by Zipcode.

source=shipment_details | stats count by SHIP_ZIPCODE | lookup geo_zipcode Zipcode AS SHIP_ZIPCODE | rename Lat as latitude, Long as longitude  | geostats latfield=latitude longfield=longitude count

I am not sure if I am using the wrong map. Any suggestion would be much appreciated

0 Karma

DalJeanis
Legend

Avoid leaving a field named as count, because it will bite you like in this example. The geostats command was happily counting the records for you -- records that had already been pre-summarized.

 source=shipment_details 
| stats count as zipcount by SHIP_ZIPCODE 
| lookup geo_zipcode Zipcode AS SHIP_ZIPCODE 
| rename Lat as latitude, Long as longitude  
| geostats latfield=latitude longfield=longitude sum(zipcount) as count
0 Karma

rmanghat
New Member

Thanks for your quick reply in providing a suggestion for optimizing the query. I still have the two issues where the shipment counts are not tallying to the numbers I have in the dataset and the zipcode does not show when I drill down on the heatmap

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...