- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I would recommend trying the optional geostats argument maxzoomlevel :
As an example: index=example | geostats maxzoomlevel=15 count by host .
Sr. Technical Support Engineer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The accepted answer only fences the zoom, the way to do what was actually asked is like this:
... | geostats binspanlat=1 binspanlong=1 ....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks this works better for me than the previous answer!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You might consider switching the Accepted
answer so that other people will get the best answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The temporary solution was to reduce the cluster size so that the clusters don't merge and also fixing the minimum and maximum zoom levels. I have limited locations on the map so i used the temporary solution. Below are the options which i played around.
option name="charting.chart.bubbleMaximumSize" 50 /option
option name="charting.chart.bubbleMinimumSize" 10 /option
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I would recommend trying the optional geostats argument maxzoomlevel :
As an example: index=example | geostats maxzoomlevel=15 count by host .
Sr. Technical Support Engineer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

See my unaccepted answer below for the correct setting to use for this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you!! This works perfectly now 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

THANK YOU.
I read before the maxzoomlevel argument, but I never used it because I understood that was like the tile > maxzoomlevel option of the GUI. I tried right now, and it worked.
For me, this is the answer that I wanted.
Thank you again.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can avoid clustering by increasing the maximum number of clusters, below I have given maximum clusters as 999. You can increase the values further if you want. keep increasing the maximum cluster values until you get satisfactory result.But splunk recommends us to keep the value as "100" for maximum performance.
option name="mapping.data.maxClusters">900
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I guess that the "problem" is relative to the maximum zoom level used by geostats. The levels are between 0 and 9. If I use opestreetmaps I get more zoom levels, but geostats represent the data always with the basic zoom levels (0-9). If geostats choose that in level 9 two or more locations will be together, I can't say "don't do it" even if I use the option name="mapping.data.maxClusters" in xml.
Well... any suggestions, please?
Regards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am running into this same problem, in that I am trying to plot points on a map, but even though OpenStreetMaps allows me to zoom down to the building level, my points plotted over the span of a few blocks always wind up being aggregated together. Any ideas on how to fix this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi there.
I have the same problem, but in 6.2.3. I tried the mapping.data.maxCluesters option, but I don't get any difference. I read the docs, but I don't find answers. Any suggestions?
Regards.
