Splunk Search

Splunk Maps

Explorer

what is the difference between cluster and cheograph maps in splunk?
and can i use cluster maps with coordinates not lat and long

1 Solution

Super Champion

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

View solution in original post

Super Champion

Hi @alaaelbahrawy,

In the link below you can find the options for the cluster-map :

https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/MarkerMap

As you can see it leverages geostatsto build the visualization which means you're limited to the number of parameters geostats takes which is this case is only one field, either total or subtotal : https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

Cheers,
David

Explorer

okay good. is there is any other way to draw 2 values in splunk maps?

0 Karma

Super Champion

One value at a time 😉 try looking for custom visualizations maybe something can add 2 values instead ?

0 Karma

Explorer

okay thanks for answering 😄

0 Karma

Super Champion

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

View solution in original post

Explorer

thanks for answering,i tries yes to change the coordinates to long and lat but i wanted it in the first place for the following case
I want the map to appear more than 1 value. like
total, subtotal
100,30
50,20

So that it can be for each country the number of total and subtotal. Can the cluster map help in this case?

0 Karma

Super Champion

cluster map uses geostats and normally it is aggregated for one value at a time.
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

0 Karma

Explorer

okaay i get it now. So can choropleth maps also use 2 values or 1 also? or is there any other way to do so using the maps.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!