All Apps and Add-ons

Clustered Single Value Map not showing correct counts

tadcarlson
Engager

I am attempting to use the Clustered Single Value Map visualization (CSVM) to show a basic count of login attempts by location. Below is my search.

 index="onlinebanking" sourcetype="Activity" EVENTID=LOGIN | iplocation IPADDRESS | geostats latfield=lat longfield=lon count

However when the map renders, the counts for the clustered values aren't even close to the statistics. The built-in Cluster Map shows the correct results, and the statistics for each search is obviously the same, but for some reason it the CSVM isn't rendering with the correct values and it's not even close. For instance CSVM will display 453 for an area, while the built-in and stats indicate 32,000. I'd really like to get to the drilled-in detail that CSVM provides, but if the values aren't accurate it doesn't do me any good.

0 Karma

damann
Communicator

Have you tried to reduce the binspan for your lat and long?

http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Geostats

Try the following:
YOURSEARCH | geostats latfield=lat longfield=lon binspanlat=0.1 binspanlong= 0.1 count

Just play a little with the values to meet your needs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...