I'm trying to find the distance between two geo coordinates and am looking for help with the search syntax.Here's what my data looks like
Index=S1 created from Sensor1.csv has Id,Lat1,Long1 and Index=S2 created from Sensor2.csv has Id,Lat2,Long2 . I need to find all Lat2 and Long2 that are within a certain distance (say 1 mile) of Lat1 and Long1. I'm ok to do something like the calculation below because I'm working in a small area and reasonable accuracy will work ..is the search syntax below correct?
index=S1 or index=S2 | eval distance=sqrt(pow(Lat1-Lat2,2)+pow(Long1-Long2,2)) ....
How would I use the Haversine formula (assuming I convert my lat long to the required x,y format that Haversine needs)
How do I use the calculated distance in my search syntax. Thanks
↧
Distance between two Geocoordinates
↧
Create a geo map based on 3 letter country code
I have a query to returns stats count based on the ISO 3 letter country code. How can I create a map visualization for this data?
↧
↧
How to geo map participants IP addresses
Hey all,
I have fields with sitename,conferenceID,"participant Type",ClientAgent, "IP Address", Jointime, Leavetime,VoIpDuration.
So, I need a geo map: Attendee locations (IP address) using ip address and when I try to use
`"........| iplocation IPAddress"` then no Country or City fields appear.
The data is getting extracted in a .CSV using a python script and .CSV file has only above mentioned fields.
So my question is:
Do I need to have country and city fields also in .csv or we can obtain locations just using ipaddress?
thanks
↧
Problem with Geospatial lookup and geom command
Hi All,
Posting this question, as I am new to Geospatial lookup and trying to configure it as per Michael Porath's blog (http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/) .
I have received a shape file, which I have converted to KML format using the steps mentioned in it, but when I run the geom command it gives me a bunch of error message as below and splunkd crashes. Here is the few output from crash log.
04-11-2016 11:19:36.534 ERROR spatial:PointInPolygonIndex - wrote 18933 grid keys
04-11-2016 11:19:44.880 INFO spatial:Util - PIP index built successfully
04-11-2016 11:19:44.889 INFO SearchOperator:Geom - did not find clipped geometry in cache for featureCollection=bambi_aus_regions_old
04-11-2016 11:19:44.889 INFO SearchOperator:Geom - generalization=1.000000
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - Num Keys in ray.key: 16923
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - Num Keys in seg.key: 4331904
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - Num Keys in grid.key: 18933
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: ray.key
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/ray.key in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: ray.val
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/ray.val in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: seg.key
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/seg.key in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: seg.val
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/seg.val in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: grid.key
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/grid.key in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: grid.val
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/grid.val in 0.001000 sec
04-11-2016 11:19:44.892 WARN spatial:PointInPolygonIndex - requested tile was at y=-92 but returned tile as at -93
In one of my local environment the geom command does produce an output in stats option but in Choropleth map section I get an error as "problem memmapping".
I tried to break the kml file into small piece and then it works.
Can you advice what needs to be performed to fix this issue .
My KML file is around 76MB and the KMZ format it comes to 20 MB. Is there a limit on the size of KML file which splunkd can process.
↧
How can I draw a line between two cities in a dashboard?
All,
I am hoping to draw a line between two sets of lat/lon in a dashboard. Looks like Google API has this. But I can't be the first person who needs to draw a line between two sets of coordinates in Splunk. Is there a way to do this with existing tools?
thanks,
↧
↧
What function or command can I use for Splunk to map the latitude and longitude into corresponding timezones?
Hi,
Currently in my data, I have latitude and longitude info for all locations around the world. Is there a way or a handy function available in Splunk to map the latitude and longitude into the corresponding timezone?
For example, as to a specific location in city of San Francisco, the time zone should be mapped to "Pacific Time Zone". Moreover, once we have the time zone mapped, could we go one step forward to get the time offset/delta to UTC? With the same example, for locations in San Francisco, the time offset to UTC is "-08:00".
Thank you!
↧
How to create a choropleth map using state abbreviations?
Does anyone know if/how you can create a choropleth map in Splunk using state abbreviations? I have been trying the following search but to no avail.
index=traffic sourcetype="traffic_logs" | stats count(id) | geom geo_us_states featureIdField=driver_state gen=0.1 min_x=-130.5 min_y=37.6 max_x=-130.1 max_y=37.7
↧
Help Mapping with the Google Maps app
I uploaded a csv file that has these latitude and longitude locations:
VictimSex VictimDescent PremiseCode PremiseDescription Address CrossStreet Long Lat
F H 101 STREET CAMPUS RD WESTDALE AV -118.212 34.1294
F A 101 STREET BURLINGTON 8TH -118.2745 34.0534
F H 101 STREET RINALDI ST SEPULVEDA BL -118.4688 34.2791
I've been trying different versions of " geostats latfield=Lat longfield=Long count by MOCodes" (MOCodes is another field in my csv file) but goole maps still gives me 0 locations.
↧