Splunk Search

Splunk Maps

alaaelbahrawy
Explorer

what is the difference between cluster and cheograph maps in splunk?
and can i use cluster maps with coordinates not lat and long

1 Solution

koshyk
Super Champion

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

View solution in original post

DavidHourani
Super Champion

Hi @alaaelbahrawy,

In the link below you can find the options for the cluster-map :

https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/MarkerMap

As you can see it leverages geostatsto build the visualization which means you're limited to the number of parameters geostats takes which is this case is only one field, either total or subtotal : https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

Cheers,
David

alaaelbahrawy
Explorer

okay good. is there is any other way to draw 2 values in splunk maps?

0 Karma

DavidHourani
Super Champion

One value at a time 😉 try looking for custom visualizations maybe something can add 2 values instead ?

0 Karma

alaaelbahrawy
Explorer

okay thanks for answering 😄

0 Karma

koshyk
Super Champion

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

alaaelbahrawy
Explorer

thanks for answering,i tries yes to change the coordinates to long and lat but i wanted it in the first place for the following case
I want the map to appear more than 1 value. like
total, subtotal
100,30
50,20

So that it can be for each country the number of total and subtotal. Can the cluster map help in this case?

0 Karma

koshyk
Super Champion

cluster map uses geostats and normally it is aggregated for one value at a time.
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

0 Karma

alaaelbahrawy
Explorer

okaay i get it now. So can choropleth maps also use 2 values or 1 also? or is there any other way to do so using the maps.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...