Combine timechart and geostats

ScottSusman — Tue, 01 Sep 2020 15:48:02 GMT

When visualizing results on a map (presumably using geostats, but maybe there's something else?) is there a way to get a small line or area chart instead of a pie chart?

Basically I have a bunch of requests over the past week or month then using iplocation to find where they are coming from. I want to see if there are places with a significantly different number of requests (preferably by http_response_status) one day from the next.

Even more basically, did we get 10K requests from (for example) St. Louis yesterday when over the past week we usually get 500? Did we get 4K 401's from Buffalo when usually they're 3K 200's.

I've tried combining iplocation, geostats, timechart, "bin + chart by _time", etc. in various ways and can't get the data to make sense. Much less to visualize it like I want.

| iplocation ip | bin _time span=1d | stats count by _time, lat, lon, http_response_status

Maybe this is two questions. 1) How to format the data and 2) Can/how to visualize it.

Thank you!

Re: Combine timechart and geostats

niketn — Mon, 14 Sep 2020 16:33:51 GMT

@ScottSusman you are possibly looking for Location Tracker Custom Visualization or may be Map + for Splunk

topic Re: Combine timechart and geostats in Dashboards & Visualizations

Combine timechart and geostats

Re: Combine timechart and geostats