Splunk Enterprise

help on custom cluster map

jip31
Motivator

hi

I use the search below in order to display the number of events corresponding to my main search on a cluster map

There is a gap between the results displayed on my map and the results of the main search

I have identified a first problem

Some sites between the lookup and splunk are a little bit differents

For example, I have a site calle "LA BA" in Splunk and "LA BAUME" in the csv

So what I have to do that the sites match well?

 

index=toto sourcetype=tutu
| stats dc(id) as nbincid by site 
| where isnotnull(site) 
| join type=left site 
    [| inputlookup Bp.csv 
    | rename siteName as site 
    | fields site latitude longitude ] 
| table site nbincid latitude longitude 
| geostats latfield=latitude longfield=longitude globallimit=0 values(nbincid)

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhua
Builder

The marker size you set on the cluster map will group locations that falls within that radius together.

View solution in original post

0 Karma

johnhua
Builder

The marker size you set on the cluster map will group locations that falls within that radius together.

0 Karma

jip31
Motivator

yes you are right

So if i well understand it's not possible to display the results on the map one shot?

last thing, I have you an idea for the site which have a different name between splunk and the lookup?

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...