Hi splunkers,
I would like to inform you that i am using below geostat spl, but i am unable to get result can anyone help me please where i am doing mistake i have chosen .csv file source type when i am trying to get spl result it says no data found
index="main" | geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry
Would be appreciate your kind support. thanks in advance
Thanks for your valuable time and support
as per your instructions i did the same steps but still unable get the result please find the below attached screen shots moreover i changed file format as well UTF-8 and ANSI but still same please help me in this Regard would be appreciate your kind support
1) index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield=vendorlatitude longfield=vendorlongitude count by vendorcountry
2)index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield="vendorlatitude" longfield="vendorlongitude" count by "vendorcountry"
if i search following query | inputsearch testlookup.csv getting results
Perhaps it's a typo, but vendor latitude is treated as two different fields - vendor and latitude. Try vendorlatitude (or whatever field is in your CSV file).
The geostats command will not reach into a random CSV file to resolve a field reference. If the field is not in the index, then use the lookup command to map existing field(s) to those used in geostats.
index=main
| lookup mylookup.csv vendor OUTPUT vendorcountry vendorlatitude vendorlongtitude
| geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry