Splunk Search

Show ratio in map and Change marker size and color based on ratio percentage

jonu4u
New Member

Hi, I'm trying to show ratio of active vs total count of students by school in a map. Whereever the ratio is less than 50% need to color that bubble by red and green otherwise.
The query im using :

|inputlookup qa.csv | table student_id, school_name| stats dc(student_id) as total by school_name | join type=left school_name [search index="qa_xapi" | table student_id,school_name| stats dc(student_id) as active by school_name] |fillnull active value=0 | eval ratio=(active/total)*100 | table school_name, ratio

Now qa.csv file contain lat,long information but the qa_xapi index doesn't contain lat,long field. The index contain active users where the lookup has total users dump so we need a left join to get active/total ratio.

So how can I bring this ratio correlation with lat,long and use geom or geostats to render this in a map. If this can be solved 90% is done then we can render the color's based on ratio using eval condition.

Also if you can suggest any other solution other than left join for this.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...