Splunk Search

How do I display negative values through geostats?

andrewtrobec
Motivator

Hello,

I'm busy mapping temperatures for locations around the world and in some cases the value is negative. Unfortunately negative values are not displayed in the map through the geostats command, so I was wondering how to enable them? I've tried setting the marker sizes so that it is the same for all values:

<option name="mapping.markerLayer.markerMaxSize">10</option>
<option name="mapping.markerLayer.markerMinSize">10</option>

But this only makes positive values the same size, negative values are still missing...

Any ideas?

Thank you!

Andrew

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That would make the value the number of cities underneath the marker with that temperature, and would make the label the temperature.

alt text

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That would make the value the number of cities underneath the marker with that temperature, and would make the label the temperature.

alt text

andrewtrobec
Motivator

This is great! The negative value now appears, thank you so much! I can't make this comment the answer... is there a way for you to move it to be an answer?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this:

base search | eval category = case(TEMP < 0, "freezing", TEMP < 15, "cold", TEMP < 25, "temperate", TEMP < 35, "hot", true(), "boiling")
| geostats latfield=LAT longfield=LON count by category

martin_mueller
SplunkTrust
SplunkTrust

You could round to whole degrees, and do a count by TEMP... then colour all reasonable values accordingly.

As long as the negative temperature is considered a value and not a split-by field, this visualization will attempt to draw a pie slice of negative area. Geometry doesn't do that.

0 Karma

andrewtrobec
Motivator

I'm not sure what you mean by "round to whole degrees. and do a count by TEMP" . Wouldn't this still make every value 1?

0 Karma

andrewtrobec
Motivator

Hey Martin,

This makes it visible since it's a count (a positive value) and not the temperature (negative value). I'd like to have the marker so that when I put by cursor on it, it shows the temperature and not the count.

Is this possible you think?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The marker is a pie chart of your various temperature categories, with the temperature used as the size of that category's slice. If you have a negative temperature, you're drawing a pie slice of negative size.

Zoom way out, to let two markers merge into one - you should see the pie.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Maybe it's just me, but I cannot picture a pie slice or marker with a negative-sized area.

KelvinFTW

0 Karma

andrewtrobec
Motivator

I know what you mean, but I don't want the marker to expand or contract based on the value being displayed. I want it to be a constant size despite being a positive or negative value.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...