Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Geostats returning the same lat lon for all events

$
0
0
Greetings, Prior to getting a stream of this data next week, I am preparing with some CSV lookups. I have two files right now, the sample data from an access point and a lookup of the AP's name and the lat lon Client Username,Client IP Address,Client MAC Address,Association Time,Vendor,AP Name,Radio Type,Device Name,Map Location,SSID,Profile,VLAN ID,Protocol,Session Duration,Policy Type,Avg. Session Throughput (Kbps) ,10.x.x.x,z:z:z:z:z:z,Fri Jun 24 17:09:26 PDT 2016,Apple,AP0000-street&avenue0,802.11a/n/ac,SVN-WLC-HDWIFI,System Campus > HDWIFI > HDWIFI-POD4,#cityWiFi,#cityWiFi,254,802.11n(5GHz),5min 12sec,NOTAVAILABLE,<0.1 so that's the data, below is the lookup AP Name,lat,lon AP0000-street&avenue0,37.697842, -123.000534 This search yields the right results: | inputcsv StreetAP |join "AP Name" [|inputcsv StreetAPtable]|rename "AP Name" as apname|stats count by apname lat lon results: apname lat lon count AP0000-street&avenue0 37.697842, -123.000534 221 This search yields all the same lat/lon | inputcsv MarketAP |join "AP Name" [|inputcsv MarketAPtable]|rename "AP Name" as apname|geostats latfield=lat longfield=lon `count by apname Where have I gone wrong?

Viewing all articles
Browse latest Browse all 47296

Trending Articles