Hi Splunkers,
I tried the new feature, Geospatial Visualization in Splunk V6.3 as "Option 1" posted on splunk blog.
http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/
But I cannot find any featureID after I put tutorial data to splunk and configured Xpath as posted on blog.
KML file "cb_2014_us_cd114_500k.zip" is the same as posted in blog and splund.log said nothing about this.
Can anyone try tutorial data and get a featureID ?
Thank you for your help.
It looks like there was a typo in the blog post. AFFGEOID
needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be
/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']
You might have to remove the my_lookup
folder from the lookups
directory where your KMZ sits so that the index is properly rebuilt.
It looks like there was a typo in the blog post. AFFGEOID
needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be
/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']
You might have to remove the my_lookup
folder from the lookups
directory where your KMZ sits so that the index is properly rebuilt.
The tutorial was very helpful. Can you explain why /Placemark/name wont work for the xpath?
I am assuming because it wont return a unique number, but it seems to be consistent among the census kml files I have been using.
Hi jzapantis,
We've added some more information concerning XPath in the geospatial documentation here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuregeospatiallookups#Xpath_and_fea...
In the example, it won't work because the KML path is different from the default feature_id_element.
Thank you very much, Michael.
I can get featureIds as values and the polygon as the following search.
source="/opt/tutorial/www1/*" index="www"
| iplocation clientip | search Country="United States" | search City!=""
| lookup my_lookup longitude as lon, latitude as lat
| stats count by featureId
| geom my_lookup