Splunk Search

How to map every event which has a lat and long field?

jdunlea
Contributor

I have 35 events. Each one has a lat and long field. How do I map each one of them to an individual point on a map? When I use geostats, it keeps trying to throw things into "geo bins".

0 Karma

DalJeanis
Legend
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Make sure you reference the latfield and longfield with geostats:

sourcetype=foo
| geostats latfield=my_laitudet_field longfield=my_longitude_field count

Otherwise, Splunk will just look for fields called lat and lon. As @mtranchita mentioned, make sure you're on the visualizations tab and have selected the appropriate visualization type.

Note where it says "Cluster Map" as the visualization type:alt text

mtranchita
Communicator

I'm likely misunderstanding the question, but are you looking at the statics tab and not the visualization - or can you change the visualization type?
I think that the example from the command reference shows what you are describing.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...