I want to create geo map using 'geostats' command and am extracting and assigning country, latitude and longitude using eval command. Source log file: Application_Name Transaction_Name Status ...
See more...
I want to create geo map using 'geostats' command and am extracting and assigning country, latitude and longitude using eval command. Source log file: Application_Name Transaction_Name Status NP_DEV_AU Homepage 0 NP_DEV_VN Homepage 0 NP_DEV_AU Login 1 NP_DEV_HK Homepage 1 NP_DEV_ID Login 0 NP_DEV_ID Homepage 0 NP_DEV_VN Login 0 NP_DEV_HK Login 1 Below is my query. index=foo host=ab03u source=*sm.log sourcetype=bol_logs | rex field=Application_Name "NP_DEV_(?<Market>\w+.*)" | rex field=Application_Name "NP_DEV_(?<Market>\w+.*)" | eval Country=case(Market=="HK","Hong Kong", Market=="TH","Thailand", Market=="VN","Vietnam", Market=="AU","Australia", Market=="ID","Indonesia", Market=="PH","Philippines", Market=="MY","Malaysia", Market=="SG","Singapore", Market=="CN","China") | chart values(Status) by Country,Transaction_Name | eval Result=case((Homepage!=Login), "Failure", (Homepage==0 AND Login==0), "Success", (Homepage==1 AND Login==1), "Failure") | eval latitude=case(Country=="Hong Kong","22.396428", Country=="Thailand","15.870032", Country=="Vietnam","14.058324", Country=="Australia","-25.274398", Country=="Indonesia","-0.789275", Country=="Philippines","12.879721", Country=="Malaysia","4.210484", Country=="Singapore","1.352083", Country=="China","35.86166") | eval longitude=case(Country=="Hong Kong","114.109497", Country=="Thailand","100.992541", Country=="Vietnam","108.277199", Country=="Australia","133.775136", Country=="Indonesia","113.921327", Country=="Philippines","121.774017", Country=="Malaysia","101.975766", Country=="Singapore","103.819836", Country=="China","104.195397") | geostats latfield=latitude longfield=longitude values(Result) by Country So, my final output will be, Country Result Australia Failure Vietnam Success Hong Kong Failure Indonesia Success From this table i want to create one geo map using 'geostats' command, output should be in bubbles. and whichever country having 'Failure' as the Result, it should shows in red color bubble & success should be in green color bubble. When i used above query, it's not showing any result for cluster map. @skakehi_splunk @rnowitzki @richgalloway @woodcock @somesoni2 @niketn ..Need all your expertise on this.