All Apps and Add-ons

Strange Behavior when using Google Maps module

Michael_Wilde
Splunk Employee
Splunk Employee

Google Maps module, when used in my advanced XML view doesn't seem to work properly.

Right now, its just a single module on a standard dashboard view. My events look like this (i have exposed the _geo field as "geo" so you can see what geonormalize is spitting out:

alt text

This all seems to work swimmingly in the Google Maps app, but when i use a search view its not behaving properly.

alt text

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Total Users" autoRun="True">
        <param name="search">sourcetype="mydata" "40.76*" "-73.98*" | geonormalize</param>
        <param name="earliest">1320588000</param>
        <param name="latest">1320620400</param>
        <param name="groupLabel">Total Users</param>
             <module name="GoogleMaps">
              <param name="height">500px</param>
              <param name="mapType">roadmap</param>
              <param name="scrollwheel">off</param>
              <param name="center">40.76,-73.98</param>
              <param name="zoomLevel">20</param>
              <param name="debug">false</param>
            </module>
  </module>

Any clue?

0 Karma
1 Solution

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

View solution in original post

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

Michael_Wilde
Splunk Employee
Splunk Employee

thanks Ziegfried. you're the best. (i deleted my other comment as the problem just "went away".

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...