Splunk Search

Geostats Not showing Data with Zero Counts

Loves-to-Learn Everything



I have a query that returns  Location(Location number, Lattitude, Longitude) and I have calculated the number of an event for the Location number.

in my Splunk query the calculated_count is calculated and displays correct value with a Location number, Lattitude Longitude


Location_Number    calculated_count      Lattitude  Longitude

10                                   300                          44.26         88.39

20                                   0                              44.10         88.40

30                                   400                          72.26         81.39


When i run geo stats as below, I do Not get data on MAP for Location 10 where calculated_count==0.


|geostats latfield=Longitude longfield=Longitude sum(calculated_count) byLocation_Number globallimit=0 maxzoomlevel=10


It plots all but the records with ZEO values. Tried looking on the forum and document but could not find anything. Please suggest

Labels (1)
Tags (1)
0 Karma

Loves-to-Learn Everything

Noticed the geostats does not give me result if 

calculated_count ==0.

If i set to 1, it returns all results.



0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!