How to create a map in dashboard panel from pivot zip code data?

[dhavamanis]

In pivot we have data like below. Can you please help us to generate the MAP chart (USA geographical location) in dashboard panel. Once after assigning this value to dashboard panel and trying to convert into MAP, nothing is showing. Please provide the necessary details to build a Map with this data. Basically we are trying to show the MAP based on location zipcode and number of users accessing the site.

Primary_Address_zip Count

07607 1201

10101 105000

10036 2000

Can you please help us for this plotting the map.

[hsesterhenn · Accepted solution]

Hi,

I don't know whether this is a typo:

You need 'lat' and 'lon' fields to use a map.

If you use the 'geostats' command you can set the field name with 'geostats latfield=Lat longfield=Long ...'.

With 'iplocation ip_fieldname' you get 'lat' and 'lon'.

Just small differences but they count 🙂

HTH,

Holger

[dhavamanis]

Thanks. The below geostats command works fine.

index=abcindex | lookup geolookup "Primary Address_ZIP" as "Primary Address_ZIP" OUTPUT latitude , longitude |geostats latfield=latitude longfield=longitude count by "Primary Address_ZIP"

[ChrisG]

You would have to do it with a lookup table that enriches the ZIP codes with their geographical data , see this previous Splunk Answers posting for pointers.

[dhavamanis]

Thanks, I am trying to build the MAP with the below query, i could see some results in the statistics view but its nothing showing in Map (zip, Lat and Long). Can you please review this query and correct me if anything wrong.

index="abcindex" | stats sum(Primary_Address_ZIP) as _geo_count by Primary_Address_ZIP | lookup geolookup Zipcode as Primary_Address_ZIP OUTPUT Lat, Long | where Lat not null AND Long not null | eval _geo=Lat+","+Long