Splunk Search

Splunk Maps

alaaelbahrawy
Explorer

what is the difference between cluster and cheograph maps in splunk?
and can i use cluster maps with coordinates not lat and long

1 Solution

koshyk
Super Champion

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

View solution in original post

DavidHourani
Super Champion

Hi @alaaelbahrawy,

In the link below you can find the options for the cluster-map :

https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/MarkerMap

As you can see it leverages geostatsto build the visualization which means you're limited to the number of parameters geostats takes which is this case is only one field, either total or subtotal : https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

Cheers,
David

alaaelbahrawy
Explorer

okay good. is there is any other way to draw 2 values in splunk maps?

0 Karma

DavidHourani
Super Champion

One value at a time 😉 try looking for custom visualizations maybe something can add 2 values instead ?

0 Karma

alaaelbahrawy
Explorer

okay thanks for answering 😄

0 Karma

koshyk
Super Champion

Please find the links to two maps and details
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChoroplethGenerate
vs
https://docs.splunk.com/Documentation/Splunk/latest/Viz/MarkerMap

The key difference is

Choropleth maps have specific data and component requirements and is more complex. A search uses the data and components to generate a Choropleth map. (ie. Data with geographic coordinates,A lookup table file defines region boundaries,Geospatial lookup)

while

Cluster Maps is simpler, use the geostats command. The geostats command generates events that include latitude and longitude coordinates for markers.

Cluster Maps needs lat & long in decimal (pure number). Can you please convert from co-ordinates to lat-long? Something like the formulae in this link

alaaelbahrawy
Explorer

thanks for answering,i tries yes to change the coordinates to long and lat but i wanted it in the first place for the following case
I want the map to appear more than 1 value. like
total, subtotal
100,30
50,20

So that it can be for each country the number of total and subtotal. Can the cluster map help in this case?

0 Karma

koshyk
Super Champion

cluster map uses geostats and normally it is aggregated for one value at a time.
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Geostats

0 Karma

alaaelbahrawy
Explorer

okaay i get it now. So can choropleth maps also use 2 values or 1 also? or is there any other way to do so using the maps.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...