All Apps and Add-ons

How to edit my search to count number of shipments and display shipment count on a map visualization?

rmanghat
New Member

My requirement is to summarize the number of shipments to all zip codes for a particular day and plot the shipment count by the corresponding zip code in a Clustered Single Value Map Visualization or any map in Splunk. I used the following search but it seems to be summarizing by the total number of Zip codes instead of the total shipments by Zipcode.

source=shipment_details | stats count by SHIP_ZIPCODE | lookup geo_zipcode Zipcode AS SHIP_ZIPCODE | rename Lat as latitude, Long as longitude  | geostats latfield=latitude longfield=longitude count

I am not sure if I am using the wrong map. Any suggestion would be much appreciated

0 Karma

DalJeanis
Legend

Avoid leaving a field named as count, because it will bite you like in this example. The geostats command was happily counting the records for you -- records that had already been pre-summarized.

 source=shipment_details 
| stats count as zipcount by SHIP_ZIPCODE 
| lookup geo_zipcode Zipcode AS SHIP_ZIPCODE 
| rename Lat as latitude, Long as longitude  
| geostats latfield=latitude longfield=longitude sum(zipcount) as count
0 Karma

rmanghat
New Member

Thanks for your quick reply in providing a suggestion for optimizing the query. I still have the two issues where the shipment counts are not tallying to the numbers I have in the dataset and the zipcode does not show when I drill down on the heatmap

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...