topic Cluster map in Dashboards & Visualizations

Cluster map

gjhaaland — Tue, 07 Nov 2023 15:47:01 GMT

Hi,

I have created a Cluster Map that show number of counts based on number of ASA blocked actions. The circle size is based on number of hits. A bigger circle represent more counts than a small circle. So far so good. It looks ok, but would be even better if I could change color based on number of counts/hits.

Is it also possible change color based on destination portnumber (80,23,22++)

Thanks

Geir

Re: Cluster map

bowesmana — Wed, 08 Nov 2023 01:26:16 GMT

If you want to get a lot of flexibility with maps, then use the maps+ vizualisation

https://splunkbase.splunk.com/app/3124

You have a number of options for defining colour by adding your colour values to the rows of your results

Re: Cluster map

gjhaaland — Wed, 08 Nov 2023 09:03:42 GMT

Hi,

Thanks. I have installed the image but it looks some difficult to use it. Is it possible to get manual or description how to use it?

Rgds

Geir

Re: Cluster map

bowesmana — Wed, 08 Nov 2023 22:24:55 GMT

In the Splunkbase site details tab there is a link to the github documentation

https://github.com/sghaskell/maps-plus

Also, there are lots of examples in the app itself, so you can look at those searches to see how they are producing things.

Re: Cluster map

gjhaaland — Thu, 09 Nov 2023 09:17:40 GMT

Thanks