All Apps and Add-ons

Using geom-data to create features for Maps+

Goesta
Explorer

Hi there,

we're trying to work around the fact that you cannot currently directly | geom in Maps +

So what we're doing instead is a multi step approach:

  1. We geom our original feature IDs from a set of KMZs
  2. We create a lookup, transforming the original "[[...][...]]" (multi-)polygon notation from the first step's result to the semicolon-separated notation that the definition of a feature requires in Maps+
  3. We run our actual query and get the features from the lookup

Now the strange thing is: Step 1 always seems to return complete polygons, because they render just fine on a Choropleth map.
This happens sort of 'in the background' though, as the polygon definition is never fully displayed on the statistics tab.
Because of that, we don't have the neccessary data to approach Step 2, as we'll only get like one or two points written to our intended output field.

Any ideas would be appreciated!

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

The app is not currently compatible with the geom command. You can use your KML/KMZ files directly to add the overlays onto the map. The only caveat is that you'll need to copy those files into the app to reference and serve them. See the docs on KML/KMZ overlays.

https://github.com/sghaskell/maps-plus#overlays

0 Karma

Goesta
Explorer

Hi there, thanks for the quick reply.
Regrettably, overlays are a bit to to static for our purpose (we've tried that before).

So what we'll probably attempt next is to go and extract the geometry from the raw KML files instead and "rex" them into a kind of feature lookup.

Out of curiosity, when you say "not currently compatible", that implies might already have that on your roadmap - is there an ETA on that yet? 😉

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...