Getting Data In

How to use spath and geom search commands to make one field called latlong?

martinstack
New Member

what am I doing wrong here. This isn't returning anything

|inputlookup geo_attr_countries 
| fields country 
| geom geo_countries featureIdField=country 
| spath output=latlong path=type.MultiPolygon.coordinates
0 Karma

DalJeanis
Legend

Your spath command is referring to a field that doesn't exist. Not sure where you got the idea there was a field named that coming out of the geom command.

Look at the output of this...

 | inputlookup geo_attr_countries | head 5
 | fields country 
 | geom geo_countries featureIdField=country 
 | spath input=geom output=lat path=coordinates{0}{0}{0}{0}
 | spath input=geom output=long path=coordinates{0}{0}{0}{1}

This is extracting the first pair of coordinates in the deeply nested array. Not sure whether that one is the one you want or not, but you can try various combinations of numbers in the various {}'s to select out the coordinates you want.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...