topic How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? in Dashboards & Visualizations https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229568#M14255 <P>I have multiple columns:</P> <PRE><CODE>source address: saddr dest address: daddr times seen: times_seen destination port: dport latitude: slat longitude: slong </CODE></PRE> <P>My report data is presented as:</P> <PRE><CODE>saddr daddr dport times_seen slat slong saddr daddr 0 12 lat long saddr daddr 1 22 lat long saddr daddr 0 15 lat long saddr daddr 1 7 lat long </CODE></PRE> <P>I'd like to see on my geostats map each dport and how many times it was seen by lat and long on the bubble. I'm getting everything working except for the addition of the "times_seen" block. Anytime I try to evaluate or add the "times_seen" I either get no results or an error.</P> <P>I'm using:</P> <PRE><CODE>index="the_index" | geostats latitude=slat longitude=slong count by dport </CODE></PRE> Tue, 29 Sep 2020 11:16:48 GMT richnsanders_70 2020-09-29T11:16:48Z How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229568#M14255 <P>I have multiple columns:</P> <PRE><CODE>source address: saddr dest address: daddr times seen: times_seen destination port: dport latitude: slat longitude: slong </CODE></PRE> <P>My report data is presented as:</P> <PRE><CODE>saddr daddr dport times_seen slat slong saddr daddr 0 12 lat long saddr daddr 1 22 lat long saddr daddr 0 15 lat long saddr daddr 1 7 lat long </CODE></PRE> <P>I'd like to see on my geostats map each dport and how many times it was seen by lat and long on the bubble. I'm getting everything working except for the addition of the "times_seen" block. Anytime I try to evaluate or add the "times_seen" I either get no results or an error.</P> <P>I'm using:</P> <PRE><CODE>index="the_index" | geostats latitude=slat longitude=slong count by dport </CODE></PRE> Tue, 29 Sep 2020 11:16:48 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229568#M14255 richnsanders_70 2020-09-29T11:16:48Z Re: How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229569#M14256 <P>index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport</P> Tue, 04 Oct 2016 18:31:40 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229569#M14256 dmaislin_splunk 2016-10-04T18:31:40Z Re: How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229570#M14257 <P>I appreciate the answer, but this combines all my ports into one value, I'd like to see the bubble show me how many of EACH port at each lat/long. What I'm already using shows me in the bubble the ports it sees, but if it sees port 0 three times, once with 17 hits, once with 10 hits and once with 5 hits, it does not appear to combine the values and show port 0 with 32 hits. Thanks again!</P> Tue, 04 Oct 2016 18:44:03 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229570#M14257 richnsanders_70 2016-10-04T18:44:03Z Re: How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229571#M14258 <P>index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport</P> Tue, 04 Oct 2016 18:46:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229571#M14258 dmaislin_splunk 2016-10-04T18:46:45Z Re: How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229572#M14259 <P>That seems to have done it, I was going way overboard in trying to solve this when it was such as simple answer. </P> <P>Thank you very much!</P> Tue, 04 Oct 2016 18:59:25 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229572#M14259 richnsanders_70 2016-10-04T18:59:25Z Re: How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229573#M14260 <P>Any time! Feel free to upvote <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 04 Oct 2016 19:01:24 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229573#M14260 dmaislin_splunk 2016-10-04T19:01:24Z Re: How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229574#M14261 <P>I did, i think!</P> Tue, 04 Oct 2016 19:06:55 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229574#M14261 richnsanders_70 2016-10-04T19:06:55Z Re: How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude? https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229575#M14262 <P>thank you!</P> Tue, 04 Oct 2016 19:07:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-modify-my-geostats-search-to-map-each-destination-port/m-p/229575#M14262 dmaislin_splunk 2016-10-04T19:07:52Z