All Apps and Add-ons

Strange Behavior when using Google Maps module

Michael_Wilde
Splunk Employee
Splunk Employee

Google Maps module, when used in my advanced XML view doesn't seem to work properly.

Right now, its just a single module on a standard dashboard view. My events look like this (i have exposed the _geo field as "geo" so you can see what geonormalize is spitting out:

alt text

This all seems to work swimmingly in the Google Maps app, but when i use a search view its not behaving properly.

alt text

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Total Users" autoRun="True">
        <param name="search">sourcetype="mydata" "40.76*" "-73.98*" | geonormalize</param>
        <param name="earliest">1320588000</param>
        <param name="latest">1320620400</param>
        <param name="groupLabel">Total Users</param>
             <module name="GoogleMaps">
              <param name="height">500px</param>
              <param name="mapType">roadmap</param>
              <param name="scrollwheel">off</param>
              <param name="center">40.76,-73.98</param>
              <param name="zoomLevel">20</param>
              <param name="debug">false</param>
            </module>
  </module>

Any clue?

0 Karma
1 Solution

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

View solution in original post

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

Michael_Wilde
Splunk Employee
Splunk Employee

thanks Ziegfried. you're the best. (i deleted my other comment as the problem just "went away".

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...