Why is my search producing "Error in 'geostats' command: The argument 'lon1' is invalid."?

[seregaserega]

Hi,

I'm trying to use the geostats command and got confusion.
I'm running my search without geostats:

some_stuff_here| fields some_field_with_value, lon1, lat1 

I see lon1, lat1 fields in output. They are valid float numbers. Then I try to apply geostats function:

some_stuff_here | fields some_field_with_value, lon1, lat1 
|  geostats latfield=lat1 longfield= lon1 sum(some_field_with_value)

** Error in 'geostats' command: The argument 'lon1' is invalid. **
What is the right way to debug that problem?

[acharlieh]

I think the space is what's tripping you up. I built a query to randomly generate some lat, long, and some_field_with_value events, and then apply geostats to it. On Splunk 6.2.3 this query fails with the same "Error in 'geostats' command: The argument 'lon1' is invalid." message:

| gentimes start=-1 increment=1h 
| eval lat1=(random()/(pow(2,31)-1)*180)-90 
| eval lon1=(random()/(pow(2,31)-1)*360)-180
| eval some_field_with_value=(random()/(pow(2,31)-1)*360)
| fields l* so*
| geostats latfield=lat1 longfield= lon1 sum(some_field_with_value)

On the same system, this query however works just fine:

| gentimes start=-1 increment=1h 
| eval lat1=(random()/(pow(2,31)-1)*180)-90 
| eval lon1=(random()/(pow(2,31)-1)*360)-180
| eval some_field_with_value=(random()/(pow(2,31)-1)*360)
| fields l* so*
| geostats latfield=lat1 longfield=lon1 sum(some_field_with_value)

Note the lack of space between the = and the name of the field in the working query.

[dwaddle]

SPAAAACE MAN

[seregaserega]

??? x=y and x= y are not the same?

[seregaserega]

So I added rename step to rename lon1, lat1 to lon, lat (default expected fields), Splunk started to run query. I'm confused. Doc says it's ok to tell geostats what fields keep longitude, latitude values.