Splunk Search

Custom cluster map complex issue: Why is join command not giving results wanted?

jip31
Motivator

hi

I use the search below in order to display markers on a map

As you can see, I use a join command in order to cross events by site between the lookup and the search

 

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| join type=left site 
    [| inputlookup BpLtLg.csv 
    | rename siteName as site 
    | fields site latitude longitude ] 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)

 

But the problem is that I have a difference between the marker displayed on the map and the reality

For example, If I do a focus on a specific site like MONTE CARLO, I have 10 events

jip31_2-1646757291577.png

But on the map, I just have 2 markers in this area with a count equal to 6 instead 10 even if I play with the zoom

jip31_1-1646757133569.png

so i understand nothing

Is it possible that this issue comes from the joind command?

If yes, is there another solution to improve my search?

thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than join + inputlookup, try lookup

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| lookup BpLtLg.csv siteName AS site OUTPUT latitude longitude 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)
0 Karma

jip31
Motivator

perfect it's better without join!

but I have the same issue

I f I have a look for a specificic site like MONTE CARLO, you cans see that I found 11 events

jip31_0-1646803402639.png

so why in this area I found only 2 markers correso

ponding to 6 events instead 12?

jip31_1-1646803522546.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)
0 Karma

jip31
Motivator

it's better now, you are the best!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...