Splunk Search

Displaying a marker for each event

Explorer

I'm trying to display markers on a map using Splunk. I'm currently trying out geostats but i don't seem to get it working.

The latitude is stored as DevEUI_location.DevLAT and longitude as DevEUI_location.DevLON.

I have tried the following:

host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON --> Displays nothing on map

host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON count --> Displays 1 big circle

I would like a marker or indicator for each event. Any idea how to do this?

Thanks

0 Karma

SplunkTrust
SplunkTrust
0 Karma

Explorer

Thanks @DalJeanis,
Using the following search:
host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON binspanlat=0.1 binspanlong=0.1 count

I got this result:
alt text

This may not be exactly what I was looking for but it will do. It would be better if I could zoom in further. I have tried setting maxzoomlevel but I think the above is the max zoom in.

Thanks for your help!

0 Karma

SplunkTrust
SplunkTrust

@jankappe - if your issue has been solved, please accept the answer so the question will show as resolved.

0 Karma

SplunkTrust
SplunkTrust

Not knowing what else you are trying to do, this streamstats code assigns a unique recno to each event and asks to have each plotted distinctly on the map.

host=jan DevEUI_location 
| streamstats count as recno 
| geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON count by recno
0 Karma

Explorer

Thanks for your answer. When running this code i get one pie chart like this:
alt text

i would like a marker or circle for each event.

0 Karma

SplunkTrust
SplunkTrust

Converting to comment so someone else may take a look. Looks like geostats is going to bin up the various recnos based on locale, so this strategy doesn't help you at all.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!