Splunk Search

How do I display negative values through geostats?

andrewtrobec
Builder

Hello,

I'm busy mapping temperatures for locations around the world and in some cases the value is negative. Unfortunately negative values are not displayed in the map through the geostats command, so I was wondering how to enable them? I've tried setting the marker sizes so that it is the same for all values:

<option name="mapping.markerLayer.markerMaxSize">10</option>
<option name="mapping.markerLayer.markerMinSize">10</option>

But this only makes positive values the same size, negative values are still missing...

Any ideas?

Thank you!

Andrew

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That would make the value the number of cities underneath the marker with that temperature, and would make the label the temperature.

alt text

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That would make the value the number of cities underneath the marker with that temperature, and would make the label the temperature.

alt text

andrewtrobec
Builder

This is great! The negative value now appears, thank you so much! I can't make this comment the answer... is there a way for you to move it to be an answer?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this:

base search | eval category = case(TEMP < 0, "freezing", TEMP < 15, "cold", TEMP < 25, "temperate", TEMP < 35, "hot", true(), "boiling")
| geostats latfield=LAT longfield=LON count by category

martin_mueller
SplunkTrust
SplunkTrust

You could round to whole degrees, and do a count by TEMP... then colour all reasonable values accordingly.

As long as the negative temperature is considered a value and not a split-by field, this visualization will attempt to draw a pie slice of negative area. Geometry doesn't do that.

0 Karma

andrewtrobec
Builder

I'm not sure what you mean by "round to whole degrees. and do a count by TEMP" . Wouldn't this still make every value 1?

0 Karma

andrewtrobec
Builder

Hey Martin,

This makes it visible since it's a count (a positive value) and not the temperature (negative value). I'd like to have the marker so that when I put by cursor on it, it shows the temperature and not the count.

Is this possible you think?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The marker is a pie chart of your various temperature categories, with the temperature used as the size of that category's slice. If you have a negative temperature, you're drawing a pie slice of negative size.

Zoom way out, to let two markers merge into one - you should see the pie.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Maybe it's just me, but I cannot picture a pie slice or marker with a negative-sized area.

KelvinFTW

0 Karma

andrewtrobec
Builder

I know what you mean, but I don't want the marker to expand or contract based on the value being displayed. I want it to be a constant size despite being a positive or negative value.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...