I have a customer with a geostats query that fails due to the parameters he uses. I am not sure yet what exactly he wants to achieve, but there seems to be a limitation in Splunk. It boils down to
| makeresults | eval Lat=40.27859 | eval Lon=10.26304 | geostats latfield=Lat longfield=Lon binspanlat=0.0002 binspanlong=0.0002
results in this Error an no result:
*Quad tree Exception: Invalid Quad tree
The search job has failed due to an error. You may be able view the job in the Job Inspector. *
What are the minimum working values for the binspan parameters, or is this an issue with the Splunk version we use (6.5.2)?
WARNING TO OTHERS: This example appears to be very resource intensive. Don't run in a production Splunk environment.
I ran this in my 7.2.1 Splunk environment and it failed as well. It used 100% cpu before it failed.
Uh, sorry for that. We have a very large setup, and I didn't notice that issue.