Splunk Search

Geostat value from field instead of count of events

skybert
Engager

I'm not able to visulize a list of values as I would.

My input is a lookup with values of kindergardens, the location (longitude, latitude), and the number of available places, like

KindergardenLatitudeLongitudeAvailPlaces
Misty Gardens15.553410.543212
Dragon's den15.634210.65334
Mighty Duck15.134210.54230

 

I would like to show a map of the kindergardens with the available places as a value.

In theory, I think this should be possible using geostats, but I can't get it to work. It almost seems like I need to split the list entries e.g. so that Dragon's den has 4 events - to use "geostat count by Kindergarden".

Is there another way of achieving this? 🙂

 

0 Karma
1 Solution

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw | eval _raw="Kindergarden	Latitude	Longitude	AvailPlaces
Misty Gardens	15.5534	10.5432	12
Dragon's den	15.6342	10.6533	4
Mighty Duck	15.1342	10.5423	0"
| multikv
| geostats latfield=Latitude longfield=Longitude   values(AvailPlaces) by  Kindergarden

ClusterMap.png

View solution in original post

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw | eval _raw="Kindergarden	Latitude	Longitude	AvailPlaces
Misty Gardens	15.5534	10.5432	12
Dragon's den	15.6342	10.6533	4
Mighty Duck	15.1342	10.5423	0"
| multikv
| geostats latfield=Latitude longfield=Longitude   values(AvailPlaces) by  Kindergarden

ClusterMap.png

Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...