Dashboards & Visualizations

How to create a map in dashboard panel from pivot zip code data?

dhavamanis
Builder

In pivot we have data like below. Can you please help us to generate the MAP chart (USA geographical location) in dashboard panel. Once after assigning this value to dashboard panel and trying to convert into MAP, nothing is showing. Please provide the necessary details to build a Map with this data. Basically we are trying to show the MAP based on location zipcode and number of users accessing the site.

Primary_Address_zip Count

07607 1201

10101 105000

10036 2000

Can you please help us for this plotting the map.

Tags (3)
0 Karma
1 Solution

hsesterhenn
Path Finder

Hi,

I don't know whether this is a typo:

You need 'lat' and 'lon' fields to use a map.

If you use the 'geostats' command you can set the field name with 'geostats latfield=Lat longfield=Long ...'.

With 'iplocation ip_fieldname' you get 'lat' and 'lon'.

Just small differences but they count 🙂

HTH,

Holger

View solution in original post

hsesterhenn
Path Finder

Hi,

I don't know whether this is a typo:

You need 'lat' and 'lon' fields to use a map.

If you use the 'geostats' command you can set the field name with 'geostats latfield=Lat longfield=Long ...'.

With 'iplocation ip_fieldname' you get 'lat' and 'lon'.

Just small differences but they count 🙂

HTH,

Holger

View solution in original post

dhavamanis
Builder

Thanks. The below geostats command works fine.

index=abcindex | lookup geolookup "Primary Address_ZIP" as "Primary Address_ZIP" OUTPUT latitude , longitude |geostats latfield=latitude longfield=longitude count by "Primary Address_ZIP"

ChrisG
Splunk Employee
Splunk Employee

You would have to do it with a lookup table that enriches the ZIP codes with their geographical data , see this previous Splunk Answers posting for pointers.

0 Karma

dhavamanis
Builder

Thanks, I am trying to build the MAP with the below query, i could see some results in the statistics view but its nothing showing in Map (zip, Lat and Long). Can you please review this query and correct me if anything wrong.

index="abcindex" | stats sum(Primary_Address_ZIP) as _geo_count by Primary_Address_ZIP | lookup geolookup Zipcode as Primary_Address_ZIP OUTPUT Lat, Long | where Lat not null AND Long not null | eval _geo=Lat+","+Long

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!