@Jeffland, Thanks for the input. I'm wondering if i can have your email and we can take this offline? I've other related questions on this topic too Many thanks ... View more

Thanks Porath, I did a search based on what you recommended and it works but within my search string I've to divide both Lat/Lon by 10000 before the search return the result. I'll try to modify it and post here again if i've any other questions ... View more

Great, you're a life saver I'll give it a try and post here if it work or not 🙂 Finger cross ... View more

Yeah, is really good 🙂 I do have some feedback on how to improve the Geofencing but too bad I'm not a developer so i cant do it but i can provide some feedback 🙂 In term of the search language, am i on the right track ? I apologise for asking that but my Splunk SPL is at the basic and i'm trying to learn everyday. Noted. I guess is okay to handle about 100 devices for now. I've to put it in real world testing to know if that will be a burden on the resources. Thanks so much ... View more

Thanks Porath, I misread the documentation in your app. I should be changing geo_my_shapes instead of featureId So the search should read like below, assuming the area is geo_SchoolCompound sourcetype=earthquakes | lookup geo_SchoolCompound latitude longitude OUTPUT featureId | stats max(mag) by featureId | geom geo_SchoolCompound featureIdField=featureId I tried looking at the lookup file created after i draw the fenced area but i couldn't find a list of coordinates within the area. Just wondering what is the background behind to make this app works. Also, will the search be extensive as there are new events coming in every few secs, thus Splunk have to do constant lookup every few sec too? Btw, i saw the Splunk conference. Great speech 🙂 ... View more

I assume your search is based on "Shapester". The lookup is to informed me when did the device entered the shaped drawn and not if the coordinates belong to any shape. (Or maybe i misread you as it could be the same meaning) Example, i've saved a drawn Geofencing in Shapester and named it as "School Compound" and that will appeared in the lookup file. The area or radius i wish to Geofence is "52,258570, 10,51598" I replaced featureID with SchoolCompound Will the search string look something like this? sourcetype=earthquakes | lookup geo_my_shapes latitude longitude OUTPUT SchoolCompound | stats max(mag) by SchoolCompound | geom geo_my_shapes featureIdField=SchoolCompound | stats count | fields - count | eval lat="52,258570" | eval lon="10,51598" | lookup geo_countries longitude as lon, latitude as lat ... View more

I did look at the map but that is not what we are looking for. We are searching for a way to write a search so that Splunk is able to identify when the device is within the drawn area. We tried to have a dashboard for user to input Lat/Lon but we dont really know how to write a search to determine/identify when a device is within the Geofencing area. We explored "Shapester" but we face the same issue of not able to write a search to determine/identify when a device is within the Geofencing area. ... View more

Thank Jeffland, I dont need to Draw the shapes within Route Map, we are okay for the user to click on "Shapester" and bring them to the App to draw the Geofencing or Area. But we are running a slight issue is that we're not too sure how we could write a search and tell Splunk that a certain device has entered the Geofence drawn on Shapester. (We have a device that is sending Lat/Lon data into Splunk every 30s.) Appreciate your help on this ... View more

Thanks DMohn, Let me read the link and digest it and come back to you if i've any questions. Anyway your explanation is pretty clear and easy to understand. You're like the expert for Map Coordinates 🙂 Appreciate it iJT 🙂 ... View more

Thanks Jplumsdaine22, I did consider doing the entire Geolocation, marking and alert outside of Splunk. But my entire system is build within Splunk so that is going to be slightly challenging. Also, how is the other system going to pick up the data that is flowing directly into Splunk? That is the part i couldn't figure out. Do you have a suggestion? ... View more

Hi Martin, I'm looking for something similar, whereby i've a device that keep sending Lat/Lon data every 30s. And I've user to input Lat/Lon and radius and marked as their respective Geofencing. Based on what you suggested, how can i write a search that will identify and trigger a alert whenever the device enter the specific zone. I'm aware there is a new app "Shapester" but i don't really know how to use that app or write a search to identify whenever a device enter the specific zone. https://splunkbase.splunk.com/app/2893/#/documentation Appreciate your input on this ... View more

Thanks DMohn, Yeah, we are doing a dashboard with text input fields or just CSV. As for the left and upper right coordinates, are you able to explain more on it or is there a link for me to read up? So i can better understand and teach my user what to input for the left and upper right coordinates. Won't a radius be easier to input (e.g. 2000m) than having to input both Left and Upper right coordinates? Also, will this type of search be extensive as it will keep looking up to the coordinate to determine if is within the marked area. ... View more

Thanks Mus, May i assume that "lat<-42 AND lon>175 OR lat<-40 AND lon>173" is the rectangle or geo box? In my design layout, I'll probably let the user define their own radius/rectangle/geo box instead of having it in the search. I guess my question is, who you be able to explain to me what does the 'lat<-42 AND lon>175 OR lat<-40 AND lon>173" mean so i can incorporate it into the design layout and save it as a lookup file. Many thanks ZhaoYong ... View more

Hi Guys, Anyone can help with the syntax provided by Somesoni2? I need to set a rule, to identify the Start or Stop if the device is not sending any data for more than 30secs. I'm kinda desperate here now .... Please help source="gps_Testing.csv" sourcetype="csv" | sort 0 _time | table _time Time ID Lat Long Heading Speed | eval Time=_time | streamstats current=f window=1 values(Lat) as prevLat values(Long) as prevLong values(_time) as prevtime by ID | eval diff=time-prevtime | where diff!=0 | table ID prevtime prevLat prevLong time Lat Long diff | eval Date=strftime(prevtime,"%Y-%m-%d") | eval Start_Time=strftime(prevtime,"%H:%M") | eval End_Time=strftime(time,"%H:%M") | rename prev* as Start* Lat as End_Lat Long as End_Long diff as Outage_Duration | table Date ID Start* End* Outage_Duration ... View more

@himynamesdave, Any luck with calculating of speed ? I'm also looking for similar solution ... View more

Thanks MuS for the fast respond 🙂 I've no issues displaying the coordinate on the various Maps but i need to display the Physical address instead of Lat & Lon on the Table. Are you able to view the Pic on the link i provided? Do you have any suggestion how this can be done? Thanks & appreciate a lot ... View more

@Mus & Martin_mueller, So far what is displayed on the table are the Lon & Lat but i need the Physical address but I'm planning to use OpenStreetMap instead of GoogleMap. https://drive.google.com/file/d/0B1nXkGdlsvvPcjBndldfcWlRQjA/view?usp=sharing How can i do it? Are the logic to display the Physical address on the table works the same on both Google Map & OpenstreetMap? Apologise Rongruspe for "hijacking' ur post but I'm also facing similar issues. ... View more

Hey Guys, @somesoni2, provided this ' source="gps_Testing.csv" sourcetype="csv" | sort 0 time | table _time Time ID Lat Long Heading Speed | eval Time=_time | streamstats current=f window=1 values(Lat) as prevLat values(Long) as prevLong values(_time) as prevtime by ID | eval diff=_time-prevtime | where diff!=0 | table ID prevtime prevLat prevLong _time Lat Long diff | eval Date=strftime(prevtime,"%Y-%m-%d") | eval Start_Time=strftime(prevtime,"%H:%M") | eval End_Time=strftime(_time,"%H:%M") | rename prev* as Start* Lat as End_Lat Long as End_Long diff as Outage_Duration | table Date ID Start_* End_* Outage_Duration ' Which work fine, showing everything i needed but every single line is group within 1 mins, which is off as most of the duration is more than 1 mins. I can't seem to find the command that establish the rules to group the Start and Stop that ; If the device stop transmitting for more than 30s, consider that as a Stop and the Next Incoming will be a New Start Can anyone help to improve this? appreciate a lot guys ... View more