Splunk Search

Using multiple geospatial lookups

sigpro1911
New Member

Thanks in advance for any help.

I currently am using a geospatial file to show devices inside or outside of a geofence.

Here is a small snippet of the search

           | lookup geo_Example1 latitude longitude
           | fillnull featureId value="outsideGeoFence"
           | where LIKE(featureId, "outsideGeoFence") 
           | fillnull value="unknown" user

I can use any single geo spatial file such as Example1 Example2 Example3 that I have loaded referencing the latitude and longitude and it works as expected.

I would ideally like to add more than one geospatial lookup to the search instead of creating multiple reports or dashboards for each specific location

I have tried simply adding another lookup to the string in different ways but it is not working once I add more thane one Geospatial reference.

Tags (2)
0 Karma

DalJeanis
Legend

Basically, you just have to rename them in between lookups to get them out of the way.

        | lookup geo_Example1 latitude longitude
        | rename featureId as featureId1, user as user1
        | lookup geo_Example2 latitude longitude
        | rename featureId as featureId2, user as user2
        | lookup geo_Example3 latitude longitude
        | rename featureId as featureId3, user as user3
        | eval featureId=coalesce(featureId1,featureId2,featureId3, "outsideAllGeoFences")
        | eval user=coalesce(user1, user2,user3,"unknown")
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...