Splunk Search

geostat question for multiple indexes

jiaqya
Builder

i have a unique type of column in 4 different indexes , but they all have similar latitude and longitude.

can i show all these 4 column values ( or percentage ) on a single geostat command...
in other words can a single geostat show 4 different values from 4 different indexes.

ex of 2 indexes . i have type=a and its percentage in index1
i have type=b and its percentage in index2

now when i run the geostat command with lat/lon , i wish to see that location on the map, showing both these 2 types and their respective percentages.

is it possible with splunk /geostat ?

0 Karma
1 Solution

mayurr98
Super Champion

hey you can try something like this

 index=index1 OR index=index2 OR index=index3 OR index=index4 | geostats latfield=lat longfield=lon values(percentage)  by type

let me know if this helps you!

View solution in original post

0 Karma

mayurr98
Super Champion

hey you can try something like this

 index=index1 OR index=index2 OR index=index3 OR index=index4 | geostats latfield=lat longfield=lon values(percentage)  by type

let me know if this helps you!

0 Karma

mayurr98
Super Champion

have you tried this?

0 Karma

jiaqya
Builder

Yes, i dumped all the different indexes into a single index with similar columns and made it easier for me. thanks..
john.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...