Dashboards & Visualizations

Geostats display custom column

rsokolova
Path Finder

Thanks in advance. I'm struggling trying to display the amount of requests per zip code however its just showing the amount of zip codes.

Search:
index=soa source="export.csv" host="misssplunksh01.corp.rndc-usa.com" index="soa" sourcetype="csv"
| geostats latfield=GEO_LAT longfield=GEO_LONG sum(TOTAL_SALES) by Zip

How the data looks like:

alt text

How the map looks like.
alt text

Please let me know if something is unclear , thanks again

0 Karma

woodcock
Esteemed Legend

Check out the geo-based examples in the Splunk Dashboard Examples app:
https://splunkbase.splunk.com/app/1603/

0 Karma

quantum_view
New Member

Try;
|stats values(TOTAL_SALES) as "Total Sales" by Zip
Sum grabs the total of all field values while stats values grabs the each key of each value and outputs them. Let me know the news pls.

0 Karma

MuS
SplunkTrust
SplunkTrust

Please add the SPL you used to create the table/map.

cheers, MuS

rsokolova
Path Finder

Thanks for helping @MuS , I've added the search to the main post.... Also tried using count , without by clause and using other app which is called maps for splunk but no luck so far.

0 Karma

MuS
SplunkTrust
SplunkTrust

Have you tried:

| geostats latfield=GEO_LAT longfield=GEO_LONG count(request_field_name) AS requests by Zip
0 Karma

rsokolova
Path Finder

@MuS , just tried but didn't work.

0 Karma

MuS
SplunkTrust
SplunkTrust

Can you please add some anonymised event samples?

0 Karma
Get Updates on the Splunk Community!

Can you customize Additional Fields in Notable Events?

Is there a way to customize which additional fields to show for which Notable event /Co-relation search ...

Index with one sourcetype - search performance / best practices

Hello,I have created a few indexes, each containing data only from one source with one sourcetype.<BR />From a ...

Traffic logs from Splunk Add-on for Cisco Meraki

Recently deployed this add-on, but it doesn't seem to bring back Traffic or URL logs like we did when using ...