topic Re: How do I modify my search so that results appear on a map? in Dashboards & Visualizations

How do I modify my search so that results appear on a map?

alanbudd — Tue, 20 Sep 2016 16:55:28 GMT

Good day

I am a new user on Splunk Enterprise and am trying to generate a map from search data.
The guy that developed the original search that I am using is no longer working here and unavailable to ask.

When I run the following search

index=radware host=x.x.x.x action="drop" NOT src="y.y.y.y" NOT src="0.0.0.0" |fields src | stats count as _geo_count by src | geoip src | search _geo=*

I do get a result set with seemingly valid results

However when I go to the visualization tab I just get a blank map

Going through older reports (stored outside of Splunk as pdfs) the above search returns valid maps.

The fact that I am getting valid results and a blank map indicates to me that the search is not the issue but could be a formatting issue.

Some advice on where to look next would be appreciated.

Thanks

Re: How do I modify my search so that results appear on a map?

sundareshr — Tue, 20 Sep 2016 17:11:35 GMT

Try this

 index=radware host=x.x.x.x action="drop" NOT src="y.y.y.y" NOT src="0.0.0.0" |fields src | stats count as _geo_count by src | geoip src | search _geo=* |  geostats latfield=src_latitude longfield=src_longitude count

Re: How do I modify my search so that results appear on a map?

alanbudd — Tue, 20 Sep 2016 17:24:33 GMT

Thanks that put the bubbles on the map.

This is an image of what the original maps looked like (didn't have enough points to post it on the original question)
I don't find any formating options on the visulation tab that seem to apply. How do I make my map look similar to the orginal?

Thanks again

Re: How do I modify my search so that results appear on a map?

sundareshr — Tue, 20 Sep 2016 17:58:16 GMT

Where did you see this?

Re: How do I modify my search so that results appear on a map?

alanbudd — Tue, 20 Sep 2016 18:21:00 GMT

Going through older reports (stored outside of Splunk as pdfs) the documentation available indicates that the person I took over from used the above search and created these maps directly within Splunk. However, I can't find any info on how they are formated.

Re: How do I modify my search so that results appear on a map?

sundareshr — Tue, 20 Sep 2016 18:38:44 GMT

There must be an app installed in your instance which was used in a dashboard.