I'm trying to display markers on a map using Splunk. I'm currently trying out geostats
but i don't seem to get it working.
The latitude is stored as DevEUI_location.DevLAT
and longitude as DevEUI_location.DevLON
.
I have tried the following:
host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON
--> Displays nothing on map
host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON count
--> Displays 1 big circle
I would like a marker or indicator for each event. Any idea how to do this?
Thanks
Looks like this may be your answer.
https://answers.splunk.com/answers/113295/plotting-points-on-a-splunk-6-map.html
Thanks @DalJeanis,
Using the following search:
host=jan DevEUI_location | geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON binspanlat=0.1 binspanlong=0.1 count
I got this result:
This may not be exactly what I was looking for but it will do. It would be better if I could zoom in further. I have tried setting maxzoomlevel but I think the above is the max zoom in.
Thanks for your help!
@jankappe - if your issue has been solved, please accept the answer so the question will show as resolved.
Not knowing what else you are trying to do, this streamstats
code assigns a unique recno
to each event and asks to have each plotted distinctly on the map.
host=jan DevEUI_location
| streamstats count as recno
| geostats latfield=DevEUI_location.DevLAT longfield=DevEUI_location.DevLON count by recno
Thanks for your answer. When running this code i get one pie chart like this:
i would like a marker or circle for each event.
Converting to comment so someone else may take a look. Looks like geostats is going to bin up the various recnos based on locale, so this strategy doesn't help you at all.