Splunk Search

increase zoom level geostats/clustermap

willemjongeneel
Communicator

Goodmorning,

I have a question on the geostats command in combination with the clustermap visualization.

Search looks like this
| search terms & stats functions
| geostats latfield=depotLatitude longfield=depotLongitude count

This leads to three points on the map of the Netherlands. I cannot zoom in to the level of detail that I want. What can I do to increase the zoomlevel?

Do I need to import some file in order to do so? Or should I change something in the search?

Thanks in advance, kind regards,
Willem Jongeneel

1 Solution

woodcock
Esteemed Legend

The problem that you are having is that you do not have any tiles set. Without tiles, zooming to near-ground level is useless because there is no detail to render so all you will see is white blankness. Therefore Splunk refuses to zoom down any lower. This is all proper and good, except that there is nothing that explains this to you, thus your confusion. The fix is easy: simply, Edit your dashboard, click the painbtrush icon to open the Format dialog, click on the Tiles tab/section and examine the URL setting, which starts out blank. Directly below this setting is a note with a sample URL to use for tiles. Copy this URL and paste it into the URL text box and save. You now have tiles and detail to render so zoom will function.

View solution in original post

woodcock
Esteemed Legend

The problem that you are having is that you do not have any tiles set. Without tiles, zooming to near-ground level is useless because there is no detail to render so all you will see is white blankness. Therefore Splunk refuses to zoom down any lower. This is all proper and good, except that there is nothing that explains this to you, thus your confusion. The fix is easy: simply, Edit your dashboard, click the painbtrush icon to open the Format dialog, click on the Tiles tab/section and examine the URL setting, which starts out blank. Directly below this setting is a note with a sample URL to use for tiles. Copy this URL and paste it into the URL text box and save. You now have tiles and detail to render so zoom will function.

to4kawa
Ultra Champion

dashboard reference

How about creating a dashboard?

Name    Type    Default Description
mapping.map.zoom    Number  2   The initial zoom level of the map.

There is the option.

0 Karma

willemjongeneel
Communicator

Hello,

thank you.

I've tried to do so.

    <option name="drilldown">none</option>
    <option name="mapping.map.center">(51.86,5.12)</option>
    <option name="mapping.map.scrollZoom">1</option>
    <option name="mapping.map.zoom">7</option>
    <option name="mapping.showTiles">1</option>
    <option name="mapping.tileLayer.maxZoom">12</option>
    <option name="mapping.type">marker</option>
    <option name="refresh.display">progressbar</option>

Now I can zoom in further, but the map just disappears. This leaves just the dots and a white background. Any idea what is thre problem here?

Thanks, kind regards,
Willem

0 Karma

to4kawa
Ultra Champion

Change tile to Openstreetmap

mapping.tileLayer.url   URL template    See description The URL to use for requesting tiles, based on the following template.
http://(s).tile.openstreetmap.org/(z)/(x)/(y).png
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...