Splunk Search

Displaying a marker for each event

jankappe
Explorer

I'm trying to display markers on a map using Splunk. I'm currently trying out geostats but i don't seem to get it working.

The latitude is stored as DevEUI_location.DevLAT and longitude as DevEUI_location.DevLON.

I have tried the following:

host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON --> Displays nothing on map

host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON count --> Displays 1 big circle

I would like a marker or indicator for each event. Any idea how to do this?

Thanks

0 Karma

DalJeanis
SplunkTrust
SplunkTrust
0 Karma

jankappe
Explorer

Thanks @DalJeanis,
Using the following search:
host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON binspanlat=0.1 binspanlong=0.1 count

I got this result:
alt text

This may not be exactly what I was looking for but it will do. It would be better if I could zoom in further. I have tried setting maxzoomlevel but I think the above is the max zoom in.

Thanks for your help!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@jankappe - if your issue has been solved, please accept the answer so the question will show as resolved.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Not knowing what else you are trying to do, this streamstats code assigns a unique recno to each event and asks to have each plotted distinctly on the map.

host=jan DevEUI_location 
| streamstats count as recno 
| geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON count by recno
0 Karma

jankappe
Explorer

Thanks for your answer. When running this code i get one pie chart like this:
alt text

i would like a marker or circle for each event.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Converting to comment so someone else may take a look. Looks like geostats is going to bin up the various recnos based on locale, so this strategy doesn't help you at all.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...