All Apps and Add-ons

Strange Behavior when using Google Maps module

Michael_Wilde
Splunk Employee
Splunk Employee

Google Maps module, when used in my advanced XML view doesn't seem to work properly.

Right now, its just a single module on a standard dashboard view. My events look like this (i have exposed the _geo field as "geo" so you can see what geonormalize is spitting out:

alt text

This all seems to work swimmingly in the Google Maps app, but when i use a search view its not behaving properly.

alt text

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Total Users" autoRun="True">
        <param name="search">sourcetype="mydata" "40.76*" "-73.98*" | geonormalize</param>
        <param name="earliest">1320588000</param>
        <param name="latest">1320620400</param>
        <param name="groupLabel">Total Users</param>
             <module name="GoogleMaps">
              <param name="height">500px</param>
              <param name="mapType">roadmap</param>
              <param name="scrollwheel">off</param>
              <param name="center">40.76,-73.98</param>
              <param name="zoomLevel">20</param>
              <param name="debug">false</param>
            </module>
  </module>

Any clue?

0 Karma
1 Solution

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

View solution in original post

ziegfried
Influencer

The reason is the _geo value seems to be constructed in reverse order (ie. <longitude>,<latitude> instread of <latitude>,<longitude>) because the field names have been assigned incorrectly. You could try to change your field extractions and swap the geo_lat and geo_lon field.

Michael_Wilde
Splunk Employee
Splunk Employee

thanks Ziegfried. you're the best. (i deleted my other comment as the problem just "went away".

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...