Splunk Enterprise

How can I resolve this geostats error?

Shakeer_Spl
Explorer

Hi splunkers,

I would like to inform you that i am using below geostat spl, but i am unable to get result can anyone help me please where i am doing mistake i have chosen .csv file source type when i am trying to get spl result it says no data found

index="main" | geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

Shakeer_Spl_0-1677098484740.pngShakeer_Spl_1-1677098537948.png

Would be appreciate your kind support. thanks in advance

Labels (2)
0 Karma

Shakeer_Spl
Explorer

Thanks for your  valuable time and support

as per your instructions i did the same steps but still unable get the result please find the below attached screen shots moreover i changed file format as well UTF-8 and ANSI but still same please help me in this Regard would be appreciate your kind support

1) index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield=vendorlatitude longfield=vendorlongitude count by vendorcountry

2)index=main
| lookup testlookup.csv splunk-testdata1 OUTPUT vendorcountry vendor latitude vendor longitude
| geostats latfield="vendorlatitude" longfield="vendorlongitude" count by "vendorcountry"

if i search  following query | inputsearch testlookup.csv getting results

Shakeer_Spl_1-1677360843914.png

 

 
 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps it's a typo, but vendor latitude is treated as two different fields - vendor and latitude. Try vendorlatitude (or whatever field is in your CSV file).

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The geostats command will not reach into a random CSV file to resolve a field reference.  If the field is not in the index, then use the lookup command to map existing field(s) to those used in geostats.

 

index=main
| lookup mylookup.csv vendor OUTPUT vendorcountry vendorlatitude vendorlongtitude 
| geostats latfield=vendorlatitude longfield=vendorlongtitude count by vendorcountry

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...