Dashboards & Visualizations

question on numbers shown on the map

jiaqya
Builder

i have configured compliance numbers to map with latitude longitude so that they show up on the cluster map (first page )
i see compliance numbers over there . When i click on it, it takes to another page showing actual values within that latitude / longitude range that i clicked .

but i see discrepancies.

for example, when i hover over a geo location i see overall compliance of 3 sites in that region shown as a single number ( probably average , im not sure )
when i click on it, it takes me to another page which shows me the 3 separate values by Site.
when i look at it, i see ex: 80,95,100 for each site . So the average value of these are 91.6
This is what i am expecting to see on the previous page, where as i see 95.7

Why is this discrepancy ?

if i see the hovering page shows 100% for these 3 sites, then when i click i find 100 as actual values on the 3 sites.
but when it is not 100, the compliance value vary between the first page and the clicked page average value.

can you give me an understanding of this.. does the first page value means average or something else on the map ?

John

Tags (1)
0 Karma
1 Solution

jiaqya
Builder

found the reason myself, there is nothing wrong with the values or the map.

the top level shows the average of all values.
the sub report was showing average of each site. obviously they wont match, ie full average Vs avg(individual averages)

View solution in original post

0 Karma

jiaqya
Builder

found the reason myself, there is nothing wrong with the values or the map.

the top level shows the average of all values.
the sub report was showing average of each site. obviously they wont match, ie full average Vs avg(individual averages)

0 Karma

niketn
Legend

@jiaqya, please go ahead and accept your own answer to mark this question as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...