All Apps and Add-ons

Strange Behavior when using Google Maps module

Michael_Wilde
Splunk Employee
Splunk Employee

Google Maps module, when used in my advanced XML view doesn't seem to work properly.

Right now, its just a single module on a standard dashboard view. My events look like this (i have exposed the _geo field as "geo" so you can see what geonormalize is spitting out:

alt text

This all seems to work swimmingly in the Google Maps app, but when i use a search view its not behaving properly.

alt text

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Total Users" autoRun="True">
        <param name="search">sourcetype="mydata" "40.76*" "-73.98*" | geonormalize</param>
        <param name="earliest">1320588000</param>
        <param name="latest">1320620400</param>
        <param name="groupLabel">Total Users</param>
             <module name="GoogleMaps">
              <param name="height">500px</param>
              <param name="mapType">roadmap</param>
              <param name="scrollwheel">off</param>
              <param name="center">40.76,-73.98</param>
              <param name="zoomLevel">20</param>
              <param name="debug">false</param>
            </module>
  </module>

Any clue?

0 Karma
1 Solution

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

View solution in original post

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

Michael_Wilde
Splunk Employee
Splunk Employee

thanks Ziegfried. you're the best. (i deleted my other comment as the problem just "went away".

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...