Splunk Search

Geostat value from field instead of count of events

skybert
Engager

I'm not able to visulize a list of values as I would.

My input is a lookup with values of kindergardens, the location (longitude, latitude), and the number of available places, like

KindergardenLatitudeLongitudeAvailPlaces
Misty Gardens15.553410.543212
Dragon's den15.634210.65334
Mighty Duck15.134210.54230

 

I would like to show a map of the kindergardens with the available places as a value.

In theory, I think this should be possible using geostats, but I can't get it to work. It almost seems like I need to split the list entries e.g. so that Dragon's den has 4 events - to use "geostat count by Kindergarden".

Is there another way of achieving this? 🙂

 

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw | eval _raw="Kindergarden	Latitude	Longitude	AvailPlaces
Misty Gardens	15.5534	10.5432	12
Dragon's den	15.6342	10.6533	4
Mighty Duck	15.1342	10.5423	0"
| multikv
| geostats latfield=Latitude longfield=Longitude   values(AvailPlaces) by  Kindergarden

ClusterMap.png

View solution in original post

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw | eval _raw="Kindergarden	Latitude	Longitude	AvailPlaces
Misty Gardens	15.5534	10.5432	12
Dragon's den	15.6342	10.6533	4
Mighty Duck	15.1342	10.5423	0"
| multikv
| geostats latfield=Latitude longfield=Longitude   values(AvailPlaces) by  Kindergarden

ClusterMap.png

Get Updates on the Splunk Community!

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...