- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using multiple geospatial lookups
![sigpro1911 sigpro1911](https://community.splunk.com/legacyfs/online/avatars/494925.jpg)
sigpro1911
New Member
09-07-2017
03:19 PM
Thanks in advance for any help.
I currently am using a geospatial file to show devices inside or outside of a geofence.
Here is a small snippet of the search
| lookup geo_Example1 latitude longitude
| fillnull featureId value="outsideGeoFence"
| where LIKE(featureId, "outsideGeoFence")
| fillnull value="unknown" user
I can use any single geo spatial file such as Example1 Example2 Example3 that I have loaded referencing the latitude and longitude and it works as expected.
I would ideally like to add more than one geospatial lookup to the search instead of creating multiple reports or dashboards for each specific location
I have tried simply adding another lookup to the string in different ways but it is not working once I add more thane one Geospatial reference.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![DalJeanis DalJeanis](https://community.splunk.com/legacyfs/online/avatars/455764.jpg)
DalJeanis
Legend
09-08-2017
03:18 PM
Basically, you just have to rename them in between lookups to get them out of the way.
| lookup geo_Example1 latitude longitude
| rename featureId as featureId1, user as user1
| lookup geo_Example2 latitude longitude
| rename featureId as featureId2, user as user2
| lookup geo_Example3 latitude longitude
| rename featureId as featureId3, user as user3
| eval featureId=coalesce(featureId1,featureId2,featureId3, "outsideAllGeoFences")
| eval user=coalesce(user1, user2,user3,"unknown")
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)