Splunk Search

How to plot a bubble representing the total number of occurrences of an event using Latitude and Longitude with geostats?

avisram
Path Finder

Hi There,

I have 158 events with three fields - latitude, longitude, and an integer value representing the total number of occurrences of an event at that location (latitude/longitude). I would like to plot a bubble representing the integer value at each location. I have tried the following search string:

index=testinputs | geostats latfield=latitude longfield=longitude count

The map remains blank and when I look at the statistics page, it is only returning 58 rows with duplicate entries for the same latitude/longitude combination (see the attached screenshot).
alt text

Any suggestions on how to achieve my desired result?

Thanks!

0 Karma
1 Solution

avisram
Path Finder

Well I feel completely silly. The data I was provided had the latitude and longitude fields reversed (i.e. the value for latitude was in the longitude field and the value for longitude was in the latitude field). So all of my points were getting plotted - except they were in Antarctica. Once I set the values correctly my points showed up in the correct locations. The search string I ended up with was:

index=testinputs | rename latitude as lon longitude as lat | geostats count as Total

View solution in original post

avisram
Path Finder

Well I feel completely silly. The data I was provided had the latitude and longitude fields reversed (i.e. the value for latitude was in the longitude field and the value for longitude was in the latitude field). So all of my points were getting plotted - except they were in Antarctica. Once I set the values correctly my points showed up in the correct locations. The search string I ended up with was:

index=testinputs | rename latitude as lon longitude as lat | geostats count as Total

somesoni2
Revered Legend

Try something like this

index=testinputs | geostats latfield=latitude longfield=longitude sum(total) as total
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...