Splunk Enterprise

How can I resolve this geostats error?

Shakeer_Spl
Explorer

Hi splunkers,

I would like to inform you that i am using below geostat spl, but i am unable to get result can anyone help me please where i am doing mistake i have chosen .csv file source type when i am trying to get spl result it says no data found

index="main" | geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

Shakeer_Spl_0-1677098484740.pngShakeer_Spl_1-1677098537948.png

Would be appreciate your kind support. thanks in advance

Labels (2)
0 Karma

Shakeer_Spl
Explorer

Thanks for your  valuable time and support

as per your instructions i did the same steps but still unable get the result please find the below attached screen shots moreover i changed file format as well UTF-8 and ANSI but still same please help me in this Regard would be appreciate your kind support

1) index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield=vendorlatitude longfield=vendorlongitude count by vendorcountry

2)index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield="vendorlatitude" longfield="vendorlongitude" count by "vendorcountry"

if i search  following query | inputsearch testlookup.csv getting results

Shakeer_Spl_1-1677360843914.png

 

 
 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps it's a typo, but vendor latitude is treated as two different fields - vendor and latitude. Try vendorlatitude (or whatever field is in your CSV file).

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The geostats command will not reach into a random CSV file to resolve a field reference.  If the field is not in the index, then use the lookup command to map existing field(s) to those used in geostats.

 

index=main
| lookup mylookup.csv vendor OUTPUT vendorcountry vendorlatitude vendorlongtitude 
| geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...