Splunk Search

Cannot find any featureID in Geospatial Visualization.

sunrise
Contributor

Hi Splunkers,

I tried the new feature, Geospatial Visualization in Splunk V6.3 as "Option 1" posted on splunk blog.
http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/

But I cannot find any featureID after I put tutorial data to splunk and configured Xpath as posted on blog.
KML file "cb_2014_us_cd114_500k.zip" is the same as posted in blog and splund.log said nothing about this.

alt text

Can anyone try tutorial data and get a featureID ?
Thank you for your help.

0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

View solution in original post

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

0 Karma

jzapantis
Path Finder

The tutorial was very helpful. Can you explain why /Placemark/name wont work for the xpath?

I am assuming because it wont return a unique number, but it seems to be consistent among the census kml files I have been using.

0 Karma

myu_splunk
Splunk Employee
Splunk Employee

Hi jzapantis,

We've added some more information concerning XPath in the geospatial documentation here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuregeospatiallookups#Xpath_and_fea...

In the example, it won't work because the KML path is different from the default feature_id_element.

0 Karma

sunrise
Contributor

Thank you very much, Michael.
I can get featureIds as values and the polygon as the following search.

source="/opt/tutorial/www1/*"  index="www"
| iplocation clientip | search Country="United States" | search City!=""
| lookup my_lookup longitude as lon, latitude as lat
| stats count by featureId
| geom my_lookup
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...