Splunk Search

Why is my cluster map working fine in verbose mode but not in fast mode?

ajitshukla
Explorer
query:- index="test"|table FIELD1,FIELD2,Latitude,Longitude,Timestamp| geostats latfield=Latitude longfield=Longitude count by FIELDD1

Result For Verbose Mode
alt text

result for fastmode:

NO RESULT FOUND

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @ajitshukla

try this: index="test"|fields FIELD1 FIELD2 Latitude Longitude Timestamp| geostats latfield=Latitude longfield=Longitude count by FIELD1

Hope this helps

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @ajitshukla

try this: index="test"|fields FIELD1 FIELD2 Latitude Longitude Timestamp| geostats latfield=Latitude longfield=Longitude count by FIELD1

Hope this helps

0 Karma

ajitshukla
Explorer

thanks its working fine

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Awesome, glad to hear it!

|fields is typically better and faster to use than |table

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...