Dashboards & Visualizations

How to create a map in dashboard panel from pivot zip code data?

dhavamanis
Builder

In pivot we have data like below. Can you please help us to generate the MAP chart (USA geographical location) in dashboard panel. Once after assigning this value to dashboard panel and trying to convert into MAP, nothing is showing. Please provide the necessary details to build a Map with this data. Basically we are trying to show the MAP based on location zipcode and number of users accessing the site.

Primary_Address_zip Count

07607 1201

10101 105000

10036 2000

Can you please help us for this plotting the map.

Tags (3)
0 Karma
1 Solution

hsesterhenn
Path Finder

Hi,

I don't know whether this is a typo:

You need 'lat' and 'lon' fields to use a map.

If you use the 'geostats' command you can set the field name with 'geostats latfield=Lat longfield=Long ...'.

With 'iplocation ip_fieldname' you get 'lat' and 'lon'.

Just small differences but they count 🙂

HTH,

Holger

View solution in original post

hsesterhenn
Path Finder

Hi,

I don't know whether this is a typo:

You need 'lat' and 'lon' fields to use a map.

If you use the 'geostats' command you can set the field name with 'geostats latfield=Lat longfield=Long ...'.

With 'iplocation ip_fieldname' you get 'lat' and 'lon'.

Just small differences but they count 🙂

HTH,

Holger

dhavamanis
Builder

Thanks. The below geostats command works fine.

index=abcindex | lookup geolookup "Primary Address_ZIP" as "Primary Address_ZIP" OUTPUT latitude , longitude |geostats latfield=latitude longfield=longitude count by "Primary Address_ZIP"

ChrisG
Splunk Employee
Splunk Employee

You would have to do it with a lookup table that enriches the ZIP codes with their geographical data , see this previous Splunk Answers posting for pointers.

0 Karma

dhavamanis
Builder

Thanks, I am trying to build the MAP with the below query, i could see some results in the statistics view but its nothing showing in Map (zip, Lat and Long). Can you please review this query and correct me if anything wrong.

index="abcindex" | stats sum(Primary_Address_ZIP) as _geo_count by Primary_Address_ZIP | lookup geolookup Zipcode as Primary_Address_ZIP OUTPUT Lat, Long | where Lat not null AND Long not null | eval _geo=Lat+","+Long

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...