Hi All,
Posting this question, as I am new to Geospatial lookup and trying to configure it as per Michael Porath's blog (http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/) .
I have received a shape file, which I have converted to KML format using the steps mentioned in it, but when I run the geom command it gives me a bunch of error message as below and splunkd crashes. Here is the few output from crash log.
04-11-2016 11:19:36.534 ERROR spatial:PointInPolygonIndex - wrote 18933 grid keys
04-11-2016 11:19:44.880 INFO spatial:Util - PIP index built successfully
04-11-2016 11:19:44.889 INFO SearchOperator:Geom - did not find clipped geometry in cache for featureCollection=bambi_aus_regions_old
04-11-2016 11:19:44.889 INFO SearchOperator:Geom - generalization=1.000000
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - Num Keys in ray.key: 16923
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - Num Keys in seg.key: 4331904
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - Num Keys in grid.key: 18933
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: ray.key
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/ray.key in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: ray.val
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/ray.val in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: seg.key
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/seg.key in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: seg.val
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/seg.val in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: grid.key
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/grid.key in 0.001000 sec
04-11-2016 11:19:44.890 INFO spatial:PointInPolygonIndex - memory mapping existing file: grid.val
04-11-2016 11:19:44.890 INFO spatial:timing:PointInPolygonIndex - memory mapped /opt/app/optier/splunk/etc/apps/BambiAdmin/lookups/bambi_aus_regions_old/grid.val in 0.001000 sec
04-11-2016 11:19:44.892 WARN spatial:PointInPolygonIndex - requested tile was at y=-92 but returned tile as at -93
In one of my local environment the geom command does produce an output in stats option but in Choropleth map section I get an error as "problem memmapping".
I tried to break the kml file into small piece and then it works.
Can you advice what needs to be performed to fix this issue .
My KML file is around 76MB and the KMZ format it comes to 20 MB. Is there a limit on the size of KML file which splunkd can process.
↧