Dashboards & Visualizations

How to create a map (geostats) with multiple fields/count by ?

Fadom1013
Explorer

Hello everyone, I'm a new in your community, thank you for the welcome 🙂

I need to display a map with several fields for each data.
I had done this for display with a single data (it works!)

 

 

 

| inputlookup  data.csv  
| search agence_rattachement="*" AND code_client_groupe=* AND nom_site=* AND id_departement=* 
| lookup villes_france.csv nom_reel AS ville_site OUTPUTNEW longitude_dgr,latitude_dgr
| lookup data-2.csv nom_site_rattachement AS  nom_site  OUTPUTNEW nombre_compresseur, numero_centrale
| geostats latfield=latitude_dgr longfield=longitude_dgr count by nom_site

 

 

 

But with a multitude of fields, it no longer works:/

I have the data (see in picture) but the map contains no points:

 

 

 

| inputlookup  data.csv  
| search agence_rattachement="*" AND code_client_groupe=* AND nom_site=* AND id_departement=* 
| lookup villes_france.csv nom_reel AS ville_site OUTPUTNEW longitude_dgr,latitude_dgr
| lookup data_2.csv nom_site_rattachement AS  nom_site  OUTPUTNEW nombre_compresseur, numero_centrale
| geostats latfield=latitude_dgr longfield=longitude_dgr translatetoxy=false count by nom_site

 

 

 

Thx you !!!! Have a good dayCapture.PNG

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

may be you can try something like below: grouped is new field show value like Country-City and calculated field is used in by clause of geostats

| makeresults | eval ip="129.10.32.10"
| iplocation ip
| eval grouped=Country+"-"+City
| geostats count by grouped

  

————————————
If this helps, give a like below.
0 Karma

Fadom1013
Explorer

Thx ! i do : 

 

 

| eval grouped = name + "_" + nb + "_" + id
| geostats latfield=latitude_dgr longfield=longitude_dgr  count by grouped

 

 



It's concatenateevery fields in one field, is good, when i am on a point of a map i have : name_number_id (he 3 fields concatenate), is good thanks !

But for the link target of the drilldown of the map i need to split it 😕 You known how ? 🙂

Because : 
<link target="_blank">/form?token=$click.name$</link> and i just nedd the name_ of the value click name (not name_nb_id)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...