Cannot find any featureID in Geospatial Visualization.

[sunrise]

Hi Splunkers,

I tried the new feature, Geospatial Visualization in Splunk V6.3 as "Option 1" posted on splunk blog.
http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/

But I cannot find any featureID after I put tutorial data to splunk and configured Xpath as posted on blog.
KML file "cb_2014_us_cd114_500k.zip" is the same as posted in blog and splund.log said nothing about this.

Can anyone try tutorial data and get a featureID ?
Thank you for your help.

[mporath_splunk · Accepted solution]

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

[jzapantis]

The tutorial was very helpful. Can you explain why /Placemark/name wont work for the xpath?

I am assuming because it wont return a unique number, but it seems to be consistent among the census kml files I have been using.

[myu_splunk]

Hi jzapantis,

We've added some more information concerning XPath in the geospatial documentation here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuregeospatiallookups#Xpath_and_fea...

In the example, it won't work because the KML path is different from the default feature_id_element.

[sunrise]

Thank you very much, Michael.
I can get featureIds as values and the polygon as the following search.

source="/opt/tutorial/www1/*"  index="www"
| iplocation clientip | search Country="United States" | search City!=""
| lookup my_lookup longitude as lon, latitude as lat
| stats count by featureId
| geom my_lookup