Splunk Search

Custom cluster map complex issue: Why is join command not giving results wanted?

jip31
Motivator

hi

I use the search below in order to display markers on a map

As you can see, I use a join command in order to cross events by site between the lookup and the search

 

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| join type=left site 
    [| inputlookup BpLtLg.csv 
    | rename siteName as site 
    | fields site latitude longitude ] 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)

 

But the problem is that I have a difference between the marker displayed on the map and the reality

For example, If I do a focus on a specific site like MONTE CARLO, I have 10 events

jip31_2-1646757291577.png

But on the map, I just have 2 markers in this area with a count equal to 6 instead 10 even if I play with the zoom

jip31_1-1646757133569.png

so i understand nothing

Is it possible that this issue comes from the joind command?

If yes, is there another solution to improve my search?

thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than join + inputlookup, try lookup

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| lookup BpLtLg.csv siteName AS site OUTPUT latitude longitude 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)
0 Karma

jip31
Motivator

perfect it's better without join!

but I have the same issue

I f I have a look for a specificic site like MONTE CARLO, you cans see that I found 11 events

jip31_0-1646803402639.png

so why in this area I found only 2 markers correso

ponding to 6 events instead 12?

jip31_1-1646803522546.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)
0 Karma

jip31
Motivator

it's better now, you are the best!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...