Splunk Search

How do I display negative values through geostats?

andrewtrobec
Motivator

Hello,

I'm busy mapping temperatures for locations around the world and in some cases the value is negative. Unfortunately negative values are not displayed in the map through the geostats command, so I was wondering how to enable them? I've tried setting the marker sizes so that it is the same for all values:

<option name="mapping.markerLayer.markerMaxSize">10</option>
<option name="mapping.markerLayer.markerMinSize">10</option>

But this only makes positive values the same size, negative values are still missing...

Any ideas?

Thank you!

Andrew

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That would make the value the number of cities underneath the marker with that temperature, and would make the label the temperature.

alt text

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That would make the value the number of cities underneath the marker with that temperature, and would make the label the temperature.

alt text

andrewtrobec
Motivator

This is great! The negative value now appears, thank you so much! I can't make this comment the answer... is there a way for you to move it to be an answer?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this:

base search | eval category = case(TEMP < 0, "freezing", TEMP < 15, "cold", TEMP < 25, "temperate", TEMP < 35, "hot", true(), "boiling")
| geostats latfield=LAT longfield=LON count by category

martin_mueller
SplunkTrust
SplunkTrust

You could round to whole degrees, and do a count by TEMP... then colour all reasonable values accordingly.

As long as the negative temperature is considered a value and not a split-by field, this visualization will attempt to draw a pie slice of negative area. Geometry doesn't do that.

0 Karma

andrewtrobec
Motivator

I'm not sure what you mean by "round to whole degrees. and do a count by TEMP" . Wouldn't this still make every value 1?

0 Karma

andrewtrobec
Motivator

Hey Martin,

This makes it visible since it's a count (a positive value) and not the temperature (negative value). I'd like to have the marker so that when I put by cursor on it, it shows the temperature and not the count.

Is this possible you think?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The marker is a pie chart of your various temperature categories, with the temperature used as the size of that category's slice. If you have a negative temperature, you're drawing a pie slice of negative size.

Zoom way out, to let two markers merge into one - you should see the pie.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Maybe it's just me, but I cannot picture a pie slice or marker with a negative-sized area.

KelvinFTW

0 Karma

andrewtrobec
Motivator

I know what you mean, but I don't want the marker to expand or contract based on the value being displayed. I want it to be a constant size despite being a positive or negative value.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...