Getting Data In

How to use spath and geom search commands to make one field called latlong?

martinstack
New Member

what am I doing wrong here. This isn't returning anything

|inputlookup geo_attr_countries 
| fields country 
| geom geo_countries featureIdField=country 
| spath output=latlong path=type.MultiPolygon.coordinates
0 Karma

DalJeanis
Legend

Your spath command is referring to a field that doesn't exist. Not sure where you got the idea there was a field named that coming out of the geom command.

Look at the output of this...

 | inputlookup geo_attr_countries | head 5
 | fields country 
 | geom geo_countries featureIdField=country 
 | spath input=geom output=lat path=coordinates{0}{0}{0}{0}
 | spath input=geom output=long path=coordinates{0}{0}{0}{1}

This is extracting the first pair of coordinates in the deeply nested array. Not sure whether that one is the one you want or not, but you can try various combinations of numbers in the various {}'s to select out the coordinates you want.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...