Splunk Enterprise

help on custom cluster map

jip31
Motivator

hi

I use the search below in order to display the number of events corresponding to my main search on a cluster map

There is a gap between the results displayed on my map and the results of the main search

I have identified a first problem

Some sites between the lookup and splunk are a little bit differents

For example, I have a site calle "LA BA" in Splunk and "LA BAUME" in the csv

So what I have to do that the sites match well?

 

index=toto sourcetype=tutu
| stats dc(id) as nbincid by site 
| where isnotnull(site) 
| join type=left site 
    [| inputlookup Bp.csv 
    | rename siteName as site 
    | fields site latitude longitude ] 
| table site nbincid latitude longitude 
| geostats latfield=latitude longfield=longitude globallimit=0 values(nbincid)

 

 

Tags (1)
0 Karma
1 Solution

johnhuang
Motivator

The marker size you set on the cluster map will group locations that falls within that radius together.

View solution in original post

0 Karma

johnhuang
Motivator

The marker size you set on the cluster map will group locations that falls within that radius together.

0 Karma

jip31
Motivator

yes you are right

So if i well understand it's not possible to display the results on the map one shot?

last thing, I have you an idea for the site which have a different name between splunk and the lookup?

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...