Splunk Search

Custom cluster map complex issue: Why is join command not giving results wanted?

jip31
Motivator

hi

I use the search below in order to display markers on a map

As you can see, I use a join command in order to cross events by site between the lookup and the search

 

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| join type=left site 
    [| inputlookup BpLtLg.csv 
    | rename siteName as site 
    | fields site latitude longitude ] 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)

 

But the problem is that I have a difference between the marker displayed on the map and the reality

For example, If I do a focus on a specific site like MONTE CARLO, I have 10 events

jip31_2-1646757291577.png

But on the map, I just have 2 markers in this area with a count equal to 6 instead 10 even if I play with the zoom

jip31_1-1646757133569.png

so i understand nothing

Is it possible that this issue comes from the joind command?

If yes, is there another solution to improve my search?

thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than join + inputlookup, try lookup

index=toto sourcetype=tutu
| stats count as PbPerf by site sam 
| search PbPerf > 10 
| stats dc(sam) as nbsam by site 
| where isnotnull(site) 
| lookup BpLtLg.csv siteName AS site OUTPUT latitude longitude 
| table site nbsam latitude longitude
| geostats latfield=latitude longfield=longitude globallimit=0 count(nbsam)
0 Karma

jip31
Motivator

perfect it's better without join!

but I have the same issue

I f I have a look for a specificic site like MONTE CARLO, you cans see that I found 11 events

jip31_0-1646803402639.png

so why in this area I found only 2 markers correso

ponding to 6 events instead 12?

jip31_1-1646803522546.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| geostats latfield=latitude longfield=longitude globallimit=0 sum(nbsam)
0 Karma

jip31
Motivator

it's better now, you are the best!

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...