Splunk Enterprise

How can I resolve this geostats error?

Shakeer_Spl
Explorer

Hi splunkers,

I would like to inform you that i am using below geostat spl, but i am unable to get result can anyone help me please where i am doing mistake i have chosen .csv file source type when i am trying to get spl result it says no data found

index="main" | geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

Shakeer_Spl_0-1677098484740.pngShakeer_Spl_1-1677098537948.png

Would be appreciate your kind support. thanks in advance

Labels (2)
0 Karma

Shakeer_Spl
Explorer

Thanks for your  valuable time and support

as per your instructions i did the same steps but still unable get the result please find the below attached screen shots moreover i changed file format as well UTF-8 and ANSI but still same please help me in this Regard would be appreciate your kind support

1) index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield=vendorlatitude longfield=vendorlongitude count by vendorcountry

2)index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield="vendorlatitude" longfield="vendorlongitude" count by "vendorcountry"

if i search  following query | inputsearch testlookup.csv getting results

Shakeer_Spl_1-1677360843914.png

 

 
 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps it's a typo, but vendor latitude is treated as two different fields - vendor and latitude. Try vendorlatitude (or whatever field is in your CSV file).

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The geostats command will not reach into a random CSV file to resolve a field reference.  If the field is not in the index, then use the lookup command to map existing field(s) to those used in geostats.

 

index=main
| lookup mylookup.csv vendor OUTPUT vendorcountry vendorlatitude vendorlongtitude 
| geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...