Splunk Enterprise

How can I resolve this geostats error?

Shakeer_Spl
Explorer

Hi splunkers,

I would like to inform you that i am using below geostat spl, but i am unable to get result can anyone help me please where i am doing mistake i have chosen .csv file source type when i am trying to get spl result it says no data found

index="main" | geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

Shakeer_Spl_0-1677098484740.pngShakeer_Spl_1-1677098537948.png

Would be appreciate your kind support. thanks in advance

Labels (2)
0 Karma

Shakeer_Spl
Explorer

Thanks for your  valuable time and support

as per your instructions i did the same steps but still unable get the result please find the below attached screen shots moreover i changed file format as well UTF-8 and ANSI but still same please help me in this Regard would be appreciate your kind support

1) index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield=vendorlatitude longfield=vendorlongitude count by vendorcountry

2)index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield="vendorlatitude" longfield="vendorlongitude" count by "vendorcountry"

if i search  following query | inputsearch testlookup.csv getting results

Shakeer_Spl_1-1677360843914.png

 

 
 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps it's a typo, but vendor latitude is treated as two different fields - vendor and latitude. Try vendorlatitude (or whatever field is in your CSV file).

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The geostats command will not reach into a random CSV file to resolve a field reference.  If the field is not in the index, then use the lookup command to map existing field(s) to those used in geostats.

 

index=main
| lookup mylookup.csv vendor OUTPUT vendorcountry vendorlatitude vendorlongtitude 
| geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...