Splunk Search

geostat question for multiple indexes

jiaqya
Builder

i have a unique type of column in 4 different indexes , but they all have similar latitude and longitude.

can i show all these 4 column values ( or percentage ) on a single geostat command...
in other words can a single geostat show 4 different values from 4 different indexes.

ex of 2 indexes . i have type=a and its percentage in index1
i have type=b and its percentage in index2

now when i run the geostat command with lat/lon , i wish to see that location on the map, showing both these 2 types and their respective percentages.

is it possible with splunk /geostat ?

0 Karma
1 Solution

mayurr98
Super Champion

hey you can try something like this

 index=index1 OR index=index2 OR index=index3 OR index=index4 | geostats latfield=lat longfield=lon values(percentage)  by type

let me know if this helps you!

View solution in original post

0 Karma

mayurr98
Super Champion

hey you can try something like this

 index=index1 OR index=index2 OR index=index3 OR index=index4 | geostats latfield=lat longfield=lon values(percentage)  by type

let me know if this helps you!

0 Karma

mayurr98
Super Champion

have you tried this?

0 Karma

jiaqya
Builder

Yes, i dumped all the different indexes into a single index with similar columns and made it easier for me. thanks..
john.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...