Splunk Maps

[alaaelbahrawy]

what is the difference between cluster and cheograph maps in splunk?
and can i use cluster maps with coordinates not lat and long

[DavidHourani]

Hi @alaaelbahrawy,

In the link below you can find the options for the cluster-map :

https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/MarkerMap

As you can see it leverages geostatsto build the visualization which means you're limited to the number of parameters geostats takes which is this case is only one field, either total or subtotal : https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

Cheers,
David

[alaaelbahrawy]

okay good. is there is any other way to draw 2 values in splunk maps?

[DavidHourani]

One value at a time 😉 try looking for custom visualizations maybe something can add 2 values instead ?

[alaaelbahrawy]

okay thanks for answering 😄

[koshyk · Accepted solution]

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

[alaaelbahrawy]

thanks for answering,i tries yes to change the coordinates to long and lat but i wanted it in the first place for the following case
I want the map to appear more than 1 value. like
total, subtotal
100,30
50,20

So that it can be for each country the number of total and subtotal. Can the cluster map help in this case?

[koshyk]

cluster map uses geostats and normally it is aggregated for one value at a time.
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

[alaaelbahrawy]

okaay i get it now. So can choropleth maps also use 2 values or 1 also? or is there any other way to do so using the maps.