Splunk Search

Custom cluster map complex issue: Why is join command not giving results wanted?

jip31
Motivator

hi

I use the search below in order to display markers on a map

As you can see, I use a join command in order to cross events by site between the lookup and the search

 

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| join type=left site 
    [| inputlookup BpLtLg.csv 
    | rename siteName as site 
    | fields site latitude longitude ] 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)

 

But the problem is that I have a difference between the marker displayed on the map and the reality

For example, If I do a focus on a specific site like MONTE CARLO, I have 10 events

jip31_2-1646757291577.png

But on the map, I just have 2 markers in this area with a count equal to 6 instead 10 even if I play with the zoom

jip31_1-1646757133569.png

so i understand nothing

Is it possible that this issue comes from the joind command?

If yes, is there another solution to improve my search?

thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than join + inputlookup, try lookup

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| lookup BpLtLg.csv siteName AS site OUTPUT latitude longitude 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)
0 Karma

jip31
Motivator

perfect it's better without join!

but I have the same issue

I f I have a look for a specificic site like MONTE CARLO, you cans see that I found 11 events

jip31_0-1646803402639.png

so why in this area I found only 2 markers correso

ponding to 6 events instead 12?

jip31_1-1646803522546.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)
0 Karma

jip31
Motivator

it's better now, you are the best!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...