https://community.splunk.com/t5/Dashboards-Visualizations/AmMaps-never-populate/m-p/96503#M44211 <P>Hello,</P> <P>When running the test script for AmMaps within my Free Enterprise Evaluation of Splunk (latest ver), no public information appears within the AmMap. Here is the test script:</P> <UL> <LI>| rex "(?<IP>\d+.\d+.\d+.\d+)"| search ip!=192.168* ip!=0.0.* ip!=10.*| stats count by ip | head 100 | eval count_label="Event" | eval iterator="ip" | eval iterator_label="IP" | eval movie_color="#FF0000" | eval output_file="home_threat_data.xml" | eval app="amMap" | lookup geoip clientip as ip | mapit</IP></LI> </UL> <P>Prior to running this scan I imported several static web logs from our web servers which do contain public ip's. </P> <P>What other search scripts would be good to test AmMaps with?</P> <P>Why is it that everytime I run a search within the AmMaps windows (map visible below the search bar), I am immediately taken back to the original search page (no map visible)?</P> <P>Any suggestions would certainly be appreciated.</P> Mon, 28 Sep 2020 09:32:09 GMT inarcisi 2020-09-28T09:32:09Z https://community.splunk.com/t5/Dashboards-Visualizations/AmMaps-never-populate/m-p/96503#M44211 <P>Hello,</P> <P>When running the test script for AmMaps within my Free Enterprise Evaluation of Splunk (latest ver), no public information appears within the AmMap. Here is the test script:</P> <UL> <LI>| rex "(?<IP>\d+.\d+.\d+.\d+)"| search ip!=192.168* ip!=0.0.* ip!=10.*| stats count by ip | head 100 | eval count_label="Event" | eval iterator="ip" | eval iterator_label="IP" | eval movie_color="#FF0000" | eval output_file="home_threat_data.xml" | eval app="amMap" | lookup geoip clientip as ip | mapit</IP></LI> </UL> <P>Prior to running this scan I imported several static web logs from our web servers which do contain public ip's. </P> <P>What other search scripts would be good to test AmMaps with?</P> <P>Why is it that everytime I run a search within the AmMaps windows (map visible below the search bar), I am immediately taken back to the original search page (no map visible)?</P> <P>Any suggestions would certainly be appreciated.</P> Mon, 28 Sep 2020 09:32:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/AmMaps-never-populate/m-p/96503#M44211 inarcisi 2020-09-28T09:32:09Z https://community.splunk.com/t5/Dashboards-Visualizations/AmMaps-never-populate/m-p/96504#M44212 <P>MAXMIND was installed prior and Splunk has been rebooted twice.</P> Fri, 06 May 2011 15:08:25 GMT https://community.splunk.com/t5/Dashboards-Visualizations/AmMaps-never-populate/m-p/96504#M44212 inarcisi 2011-05-06T15:08:25Z