geostats binspanlat/long restrictions

[knielsen]

Hello,

I have a customer with a geostats query that fails due to the parameters he uses. I am not sure yet what exactly he wants to achieve, but there seems to be a limitation in Splunk. It boils down to

 | makeresults | eval Lat=40.27859 | eval Lon=10.26304  |  geostats latfield=Lat longfield=Lon binspanlat=0.0002 binspanlong=0.0002 

results in this Error an no result:

*Quad tree Exception: Invalid Quad tree
The search job has failed due to an error. You may be able view the job in the Job Inspector. *

What are the minimum working values for the binspan parameters, or is this an issue with the Splunk version we use (6.5.2)?

Thanks,
Kai.

[chrisyounger]

WARNING TO OTHERS: This example appears to be very resource intensive. Don't run in a production Splunk environment.

I ran this in my 7.2.1 Splunk environment and it failed as well. It used 100% cpu before it failed.

[knielsen]

Uh, sorry for that. We have a very large setup, and I didn't notice that issue.