icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading haversine
SHA256 checksum (haversine_20.tgz) d758db3e46bb81a0c6dd08c2aade5b68d2c8379d6532fa081bc78a6beedf1e89 SHA256 checksum (haversine_10.tgz) 98c1963dc6ed8a4233a0b7dc0a3b04ffc6200a48170e8cc93e04fb4085cb1353
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate



This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Calculates the distance between two points represented via latitude and longitude. Augments each relevant event with the resultant distance, stored in a field named 'distance' or another field as specified. Latitude and longitude for input must be represented in decimal degree format, though separate input fields may be specified for each. Units are in kilometers by default, but optionally represented in miles.

Haversine calculates the distance between two points represented via latitude and longitude using the haversine formula. It augments each event with the calculated distance, storing the result in a field named 'distance' or another field optionally specified by the user.

While the distance between two points is a relatively basic piece of data, this tool provides a piece of information absent from many tools that provide location awareness (a common example might be an IP geo-location utility).

Knowledge of distance between two points can enhance understanding of user behavior and demographics, origin of security events, illustrate patterns of movement and velocity, and identify anomalies related to specific locations.


General usage information:

Latitude and longitude for input must be represented in decimal degree format (e.g. "-44.11,78.23"), though separate input fields may be specified for each. The default unit of distance is the kilometer, but output in miles may be optionally requested by the user. The point of origin relative to which distance is calculated can be specified as a static value or dynamically from data provided in each event.



haversine outputField=fieldname units=mi|km (origin="latitude,longitude" | originField=fieldname) (inputFieldName | inputFieldLat=fieldname inputFieldLon=fieldname | inputLatitudeFieldName inputLongitudeFieldName)


Example Use

Calculate the distance of a lat/lon pair stored in field 'latlon' relative to a static point of origin, storing result in a custom field named 'dist'
... | haversine origin="-39.44,88.12" outputField=dist latlon
... | haversine origin="-39.44,88.12" outputField=dist lat lon

Specify input field names for latitude, longitude, and origin; the relevant field values are extracted from each event. Stores the calculated distance (using miles as a unit of measure) in an output field named 'dist'.

... | haversine originField=my_location units=mi inputFieldLat=lat inputFieldLon=lon outputField=dist

Calculate the distance of a lat/lon pair stored in field 'latlon' relative to an origin, storing result in the default output field 'distance'
... | haversine origin="-39.44,88.12" latlon


Applied example

sourcetype="apache" GET somepage.php | iplocation src_ip | haversine origin="-47.31,80.33" lat lon | stats avg(distance) as "Avg. Distance" by UserID

Release Notes

Version 2.0
March 20, 2015

This new release provides a bugfix or two, a bit more flexibility in syntax, and documentation updates.

Version 1.0
March 15, 2012

2013-07-05: Documentation updated to more clearly indicate that the longitude and latitude used as a point of origin can be either a) specified statically in the command invocation, or b) extracted from each event


Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.