Splunk Search

Using multiple geospatial lookups

New Member

Thanks in advance for any help.

I currently am using a geospatial file to show devices inside or outside of a geofence.

Here is a small snippet of the search

           | lookup geo_Example1 latitude longitude
           | fillnull featureId value="outsideGeoFence"
           | where LIKE(featureId, "outsideGeoFence") 
           | fillnull value="unknown" user

I can use any single geo spatial file such as Example1 Example2 Example3 that I have loaded referencing the latitude and longitude and it works as expected.

I would ideally like to add more than one geospatial lookup to the search instead of creating multiple reports or dashboards for each specific location

I have tried simply adding another lookup to the string in different ways but it is not working once I add more thane one Geospatial reference.

Tags (2)
0 Karma


Basically, you just have to rename them in between lookups to get them out of the way.

        | lookup geo_Example1 latitude longitude
        | rename featureId as featureId1, user as user1
        | lookup geo_Example2 latitude longitude
        | rename featureId as featureId2, user as user2
        | lookup geo_Example3 latitude longitude
        | rename featureId as featureId3, user as user3
        | eval featureId=coalesce(featureId1,featureId2,featureId3, "outsideAllGeoFences")
        | eval user=coalesce(user1, user2,user3,"unknown")
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!