Splunk Search

Using GeoStats to point locations based on eval values

richaGindodia
Path Finder

My UseCase

I am using splunk to monitor a file which has latitude, longitude and CPUUsage values . I want splunk to highlight the point where CPUUsage is >75 . I tried using

index=* | geostats latfield=Latitude longfield=Longitude count | eval redCount = if(CPUUsage >75,CPUUsage,0) | eval yellowCount = if(CPUUsage <75,CPUUsage,0) |fields - CPUUsage
Then using fieldcolours

but in vain. Please Help.

0 Karma

chimell
Motivator

Hi richaGindodia

1- Use the following search code for splunk 6.2.x

index=* |where CPUUsage >75 |geostats latfield=Latitude longfield=Longitude count by CPUUsage

In visualisation tab go to chart type and select map.

2- Use the following simple xml code for splunk 6.1.x

<dashboard>
  <label>enter your dashboard name</label>
  <row>
    <panel>
      <map>
        <searchString>
         index=* |where CPUUsage >75 |geostats  globallimit=0 latfield=Latitude longfield=Longitude count by CPUUsage
          <earliest>0</earliest>
          <latest>now</latest>
        </searchString>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.drilldown">all</option>
        <option name="mapping.map.center">(0,0)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.tileLayer.maxZoom">7</option>
        <option name="mapping.tileLayer.minZoom">0</option>
      </map>
    </panel>
  </row>
</dashboard>
0 Karma

richaGindodia
Path Finder

Hello Chimell,

Thank you for a response. But this doesnot serve my purpose. Though it highlights the lat-long combinations where CPU>75 but in process it removes all those wherein CPU<75. I wanted CPU>75 in RED, CPU<75 in GREEN and CPU=0 in GREY.

I think the question I posted was a bit confusing 😞 . Hope this clears the use-case.

0 Karma

richaGindodia
Path Finder

I was able to find an answer to this. Achieved it using rangemap

| rangemap field=CPU Good=0-30 Fair=30-40 Bad=40-100 | geostats latfield=Latitude longfield=Longitude count by range
{Good:0x008000,Fair:0xFFFF00,Bad:0xFF0000}

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...