All Apps and Add-ons

Using geom-data to create features for Maps+

Explorer

Hi there,

we're trying to work around the fact that you cannot currently directly | geom in Maps +

So what we're doing instead is a multi step approach:

  1. We geom our original feature IDs from a set of KMZs
  2. We create a lookup, transforming the original "[[...][...]]" (multi-)polygon notation from the first step's result to the semicolon-separated notation that the definition of a feature requires in Maps+
  3. We run our actual query and get the features from the lookup

Now the strange thing is: Step 1 always seems to return complete polygons, because they render just fine on a Choropleth map.
This happens sort of 'in the background' though, as the polygon definition is never fully displayed on the statistics tab.
Because of that, we don't have the neccessary data to approach Step 2, as we'll only get like one or two points written to our intended output field.

Any ideas would be appreciated!

0 Karma

Splunk Employee
Splunk Employee

The app is not currently compatible with the geom command. You can use your KML/KMZ files directly to add the overlays onto the map. The only caveat is that you'll need to copy those files into the app to reference and serve them. See the docs on KML/KMZ overlays.

https://github.com/sghaskell/maps-plus#overlays

0 Karma

Explorer

Hi there, thanks for the quick reply.
Regrettably, overlays are a bit to to static for our purpose (we've tried that before).

So what we'll probably attempt next is to go and extract the geometry from the raw KML files instead and "rex" them into a kind of feature lookup.

Out of curiosity, when you say "not currently compatible", that implies might already have that on your roadmap - is there an ETA on that yet? 😉

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!