All Apps and Add-ons

Marker clustering with string values

support0
Path Finder

Hello,

I am trying to monitor VPN statuses using this nice viz.

I have been able to to do some little things thanks to github examples.

It shows a Europe map with green markers from working VPN tunnels and red markers for the ones that fell down.

However, I would like to enhance clustering usage.

With clustering enabled, it groups close markers and indicate the number of grouped markers inside. But marker color remains green despite having one red marker inside the group. That is my problem:

alt text

while one is actually not OK when zooming :

alt text

I am wondering how it would be possible to :

  • either change the color of the clusterer marker based on the value (string) of one marker inside
  • or get a marker out of a clustered marker as soon as it is a red marker

Thanks in advance for any hint

1 Solution

jkat54
SplunkTrust
SplunkTrust

Marker Priority

Version 1.4.4 introduces the ability to prioritize how markers are rendered on the map. Higher priority markers will render on top of lower priority markers. This is especially useful for dense maps where you need certain markers to stand out over others.

Use the following setting to set the marker priority.

markerPriority

Number used to set marker priority. Higher value numbers render over lower value numbers. Set a high value like 1000 (or a high negative value to render beneath). Default 0

base_search | table latitude, longitude [ description | title | icon | markerColor | markerType | markerPriority | markerSize | markerAnchor | markerVisibility | iconColor | shadowAnchor | shadowSize | prefix | extraClasses | layerDescription | pathWeight | pathOpacity]

Final Search for you might be something like this:

base search 
| eval markerColor = case(like(connectivity, "false"), "red", like(connectivity, "true"), "green", 1=1, "blue"), icon=case(like(connectivity, "false"), "exclamation", like(connectivity, "true"), "check-circle", 1=1, "circle") ,markerPriority=case(like(connectivity,"false"), 100,like(connectivity,"true"),0,1=1,50)
| table latitude, longitude, description, markerColor, markerPriority, icon

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Marker Priority

Version 1.4.4 introduces the ability to prioritize how markers are rendered on the map. Higher priority markers will render on top of lower priority markers. This is especially useful for dense maps where you need certain markers to stand out over others.

Use the following setting to set the marker priority.

markerPriority

Number used to set marker priority. Higher value numbers render over lower value numbers. Set a high value like 1000 (or a high negative value to render beneath). Default 0

base_search | table latitude, longitude [ description | title | icon | markerColor | markerType | markerPriority | markerSize | markerAnchor | markerVisibility | iconColor | shadowAnchor | shadowSize | prefix | extraClasses | layerDescription | pathWeight | pathOpacity]

Final Search for you might be something like this:

base search 
| eval markerColor = case(like(connectivity, "false"), "red", like(connectivity, "true"), "green", 1=1, "blue"), icon=case(like(connectivity, "false"), "exclamation", like(connectivity, "true"), "check-circle", 1=1, "circle") ,markerPriority=case(like(connectivity,"false"), 100,like(connectivity,"true"),0,1=1,50)
| table latitude, longitude, description, markerColor, markerPriority, icon

support0
Path Finder

Indeed working as a workaround! Thanks

alt text

0 Karma

sanshy01
Engager

How can I make the above solution happen for GeoStats where I want different color marker for different event values without aggregation of Lat Long

0 Karma

jkat54
SplunkTrust
SplunkTrust

No problem, anytime!

It's not really a work around though. It's what they documented as how to do it with this particular visualization.

0 Karma

DalJeanis
Legend

Does that viz or any similar one have any support for flags being different colors for different series?

You could use the series as red/green color and switch which series a marker belonged to in the data as a method of de-aggregating it.

0 Karma

support0
Path Finder

Yes, search looks like this :

base search | eval markerColor = case(like(connectivity, "false"), "red", like(connectivity, "true"), "green", 1=1, "blue"), icon=case(like(connectivity, "false"), "exclamation", like(connectivity, "true"), "check-circle", 1=1, "circle") | table latitude, longitude, description, markerColor, icon

I think I can do something with priorities but does not really solve my problem. A de-aggregating method ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...