Splunk Search

How to specify the range of longitude and latitude

Zhangyy
New Member

Use iplocation or geostats to display within a range of 100 kilometers (with longitude of 0.89 degrees and latitude of 0.91 degrees) which regions' people have logged in, the login time, IP address, and the login method.

Labels (1)
0 Karma

Zhangyy
New Member

Thank you all for your timely reply. Sorry, it might be difficult to understand because the scope was not specified specifically

May I ask how to write SPL within the following range?

Latitude: From 35.5 degrees north latitude to 36.0 degrees north latitude

Longitude: From 139.5 degrees east longitude to 140.0 degrees

 

I wrote some content but an error occurred
index=xxxxx
| table FROM_IP
| iplocation FROM_IP
| where latitude >= 35.5 AND latitude <= 36.0
| where longitude >= 139.5 AND longitude <= 140

Thanks

0 Karma

livehybrid
Champion

Hi @Zhangyy 

This should give you approx 25km in each direction as you've explaine:

| where lat>=35.5 AND lat<=36.0 AND lon>=139.5 AND lon<=140.0

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Zhangyy ,

try without dots and use quotes.

Ciao.

Giuseppe

0 Karma

livehybrid
Champion

Hi @Zhangyy 

You could try the following:

| iplocation yourIPField
| where abs(lon - 0.89) <= (100/111) AND abs(lat - 0.91) <= (100/111) 

This checks if a point with coordinates (lonlat) is within a rectangular area centered at (0.89, 0.91) with a "radius" of approximately 0.9009 degrees in both the longitude and latitude directions. This rectangle is approximately 100 kilometers wide and 100 kilometers tall, assuming a rough conversion of 1 degree of latitude to 111 kilometers.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Not entirely sure what you're trying to do, but this is a macro for the haversine formula

eval hv_rlat1 = pi()*$dest_lat$/180, hv_rlat2=pi()*$source_lat$/180, hv_rlat = pi()*($source_lat$-$dest_lat$)/180, hv_rlon= pi()*($source_lon$-$dest_lon$)/180 
| eval hv_a = sin(hv_rlat/2) * sin(hv_rlat/2) + cos(hv_rlat1) * cos(hv_rlat2) * sin(hv_rlon/2) * sin(hv_rlon/2) 
| eval hv_c = 2 * atan2(sqrt(hv_a), sqrt(1-hv_a)) 
| eval distance = round(6371 * hv_c * 1000,0)
| fields - hv_rlat, hv_rlat1, hv_rlon, hv_rlon1, hv_a, hv_c

Set it up to take 4 parameters and these are the named params

source_lat, source_lon, dest_lat, dest_lon

Then you can just use 

`haversine(a_lat, a_lon, b_lat, b_lon)`

to get the distance between two points

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Zhangyy ,

latitude and longitude are numbers, so you can use the greater than (>) and less than (<) operators in your searches.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...