Getting Data In

How to use spath and geom search commands to make one field called latlong?

martinstack
New Member

what am I doing wrong here. This isn't returning anything

|inputlookup geo_attr_countries 
| fields country 
| geom geo_countries featureIdField=country 
| spath output=latlong path=type.MultiPolygon.coordinates
0 Karma

DalJeanis
Legend

Your spath command is referring to a field that doesn't exist. Not sure where you got the idea there was a field named that coming out of the geom command.

Look at the output of this...

 | inputlookup geo_attr_countries | head 5
 | fields country 
 | geom geo_countries featureIdField=country 
 | spath input=geom output=lat path=coordinates{0}{0}{0}{0}
 | spath input=geom output=long path=coordinates{0}{0}{0}{1}

This is extracting the first pair of coordinates in the deeply nested array. Not sure whether that one is the one you want or not, but you can try various combinations of numbers in the various {}'s to select out the coordinates you want.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...