Splunk Search

Cannot find any featureID in Geospatial Visualization.

sunrise
Contributor

Hi Splunkers,

I tried the new feature, Geospatial Visualization in Splunk V6.3 as "Option 1" posted on splunk blog.
http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/

But I cannot find any featureID after I put tutorial data to splunk and configured Xpath as posted on blog.
KML file "cb_2014_us_cd114_500k.zip" is the same as posted in blog and splund.log said nothing about this.

alt text

Can anyone try tutorial data and get a featureID ?
Thank you for your help.

0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

View solution in original post

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

0 Karma

jzapantis
Path Finder

The tutorial was very helpful. Can you explain why /Placemark/name wont work for the xpath?

I am assuming because it wont return a unique number, but it seems to be consistent among the census kml files I have been using.

0 Karma

myu_splunk
Splunk Employee
Splunk Employee

Hi jzapantis,

We've added some more information concerning XPath in the geospatial documentation here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuregeospatiallookups#Xpath_and_fea...

In the example, it won't work because the KML path is different from the default feature_id_element.

0 Karma

sunrise
Contributor

Thank you very much, Michael.
I can get featureIds as values and the polygon as the following search.

source="/opt/tutorial/www1/*"  index="www"
| iplocation clientip | search Country="United States" | search City!=""
| lookup my_lookup longitude as lon, latitude as lat
| stats count by featureId
| geom my_lookup
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...