Splunk Search

Cannot find any featureID in Geospatial Visualization.

sunrise
Contributor

Hi Splunkers,

I tried the new feature, Geospatial Visualization in Splunk V6.3 as "Option 1" posted on splunk blog.
http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/

But I cannot find any featureID after I put tutorial data to splunk and configured Xpath as posted on blog.
KML file "cb_2014_us_cd114_500k.zip" is the same as posted in blog and splund.log said nothing about this.

alt text

Can anyone try tutorial data and get a featureID ?
Thank you for your help.

0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

View solution in original post

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of
/Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID]
it should be

/Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID']

You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt.

0 Karma

jzapantis
Path Finder

The tutorial was very helpful. Can you explain why /Placemark/name wont work for the xpath?

I am assuming because it wont return a unique number, but it seems to be consistent among the census kml files I have been using.

0 Karma

myu_splunk
Splunk Employee
Splunk Employee

Hi jzapantis,

We've added some more information concerning XPath in the geospatial documentation here: http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Configuregeospatiallookups#Xpath_and_fea...

In the example, it won't work because the KML path is different from the default feature_id_element.

0 Karma

sunrise
Contributor

Thank you very much, Michael.
I can get featureIds as values and the polygon as the following search.

source="/opt/tutorial/www1/*"  index="www"
| iplocation clientip | search Country="United States" | search City!=""
| lookup my_lookup longitude as lon, latitude as lat
| stats count by featureId
| geom my_lookup
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...