All Apps and Add-ons

How to edit my search to count number of shipments and display shipment count on a map visualization?

rmanghat
New Member

My requirement is to summarize the number of shipments to all zip codes for a particular day and plot the shipment count by the corresponding zip code in a Clustered Single Value Map Visualization or any map in Splunk. I used the following search but it seems to be summarizing by the total number of Zip codes instead of the total shipments by Zipcode.

source=shipment_details | stats count by SHIP_ZIPCODE | lookup geo_zipcode Zipcode AS SHIP_ZIPCODE | rename Lat as latitude, Long as longitude  | geostats latfield=latitude longfield=longitude count

I am not sure if I am using the wrong map. Any suggestion would be much appreciated

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Avoid leaving a field named as count, because it will bite you like in this example. The geostats command was happily counting the records for you -- records that had already been pre-summarized.

 source=shipment_details 
| stats count as zipcount by SHIP_ZIPCODE 
| lookup geo_zipcode Zipcode AS SHIP_ZIPCODE 
| rename Lat as latitude, Long as longitude  
| geostats latfield=latitude longfield=longitude sum(zipcount) as count
0 Karma

rmanghat
New Member

Thanks for your quick reply in providing a suggestion for optimizing the query. I still have the two issues where the shipment counts are not tallying to the numbers I have in the dataset and the zipcode does not show when I drill down on the heatmap

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...