Monitoring Splunk

Choropleth: Failed to memory map index files

Builder

Hi splunkers!
While trying to add KMZ file to use awesome choropleth map with my country I got this error:
Failed to memory map index files.

Here is a piece of search.log:

03-23-2016 20:18:13.983 INFO  spatial:Util - fullPath to spatial polygons data file: /opt/splunk/etc/apps/play/lookups/regions2010_wgs.kmz
03-23-2016 20:18:13.983 INFO  spatial:Util - using disk index: /opt/splunk/etc/apps/play/lookups/ru_regions
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - Num Keys in ray.key: 0
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - Num Keys in seg.key: 0
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - Num Keys in grid.key: 0
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - memory mapping existing file: ray.key
03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument
03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file ray.key
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - memory mapping existing file: ray.val
03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument
03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file ray.val
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - memory mapping existing file: seg.key
03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument
03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file seg.key
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - memory mapping existing file: seg.val
03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument
03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file seg.val
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - memory mapping existing file: grid.key
03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument
03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file grid.key
03-23-2016 20:18:13.987 INFO  spatial:PointInPolygonIndex - memory mapping existing file: grid.val
03-23-2016 20:18:13.987 ERROR spatial:PointInPolygonIndex - Memmap failed, file len 0 : Invalid argument
03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - can not read index file grid.val
03-23-2016 20:18:13.987 FATAL spatial:PointInPolygonIndex - memmap failed! no valid keys and values

Our file is in kmz, it contains filled Name param (featureid).
Search string that I used:

source=purchases | geoip ip_address | lookup ru_regions longitude as ip_address_longitude, latitude as ip_address_latitude | stats count by featureId | geom ru_regions

Link for downloading kmz file:
http://gis-lab.info/data/rusbounds-rosreestr/regions2010_wgs.kmz
Test geodata:
test_data.csv
Hope for your help, I want this cool viz so much:)

Path Finder

I am like 99.999% sure its the KML that you are using.

The regions that you have defined are not unique... therefore when there is a mapping from splunk onto the geom it is confused on which area you are talking about.

Just a quick look at your KMZ shows that you have a lot of "avtocod" that are named the same (e.g. 87, 29) and that is the default featureId that you are using. The only reason I know this is because I just had the same issue.

Try using "/Placemark/region" as your Feature Id Element.

Builder

Thanks for your answer! Unfortunately changing feature id element name in lookup definition didn't help( I attached sample geodata in csv, maybe it can help.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!