Splunk Search

Can I use geostats without latitude and longitude fields in my log

iyersudh
Explorer

The application log I am working with has ISO 3166 country code but no latitude and longitude details.

With that I am able to use a choropleth using the geom command easily using featureIdFIeld=countryname but I want to also visualize a cluster map also by country. Is there a way I can use geostats on this log without having latitude and longitude? 

Tags (1)

inventsekar
SplunkTrust
SplunkTrust

Hi @iyersudh geostats command uses lat and long to plot over the map (The events are clustered based on latitude and longitude fields in the events).
without lat/long, it is impossible to work on the maps(or, maybe some apps/addons need to be designed for this task). 

everybody prefers the simple and easy route... ie, uploading/adding the lat/long lookup file to a splunk environment.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

to4kawa
Ultra Champion

There is not the way  to geostats command without lat & long.

https://gist.github.com/sindresorhus/1341699
you should make the lookup like above.

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...