https://community.splunk.com/t5/Splunk-Search/use-amMap-without-a-lookup/m-p/55490#M13552 <P>That will work as well. Whether you use maxmind, a custom CSV, or the search language ... the goal is the same: Make sure mapit has <A href="http://splunk-base.splunk.com/answers/4029/how-do-i-use-the-splunk-for-ammap-app-posted-on-splunkbase">what it needs</A> to plot your data on an amMap. Here is an example of plotting two points exclusively using the search language, sans lookup(s):</P> <PRE><CODE>| stats count | eval count=1000| eval ip="127.0.0.1" | eval client_city="Santa Claus" | eval client_region="IN" | eval client_country="USA" | eval client_lon="-86.913958" | eval client_lat="38.120445" | eval movie_color="#FF0000" | append [| stats count | eval count=100| eval ip="10.0.0.1" | eval client_city="RMS" | eval client_region="Titanic" | eval client_country="Atlantic" | eval client_lon=-41 | eval client_lat=49 | eval movie_color="#8b8b8b"] | eval iterator="ip" | eval iterator_label="match or IP" | eval count_label="count" | eval output_file="home_threat_data.xml" | eval app="amMap" | mapit </CODE></PRE> Thu, 23 Feb 2012 15:12:47 GMT bwooden 2012-02-23T15:12:47Z https://community.splunk.com/t5/Splunk-Search/use-amMap-without-a-lookup/m-p/55489#M13551 <P>amMap works fine using a lookup, but what if the data already has the client_city, client_region, client_country, client_lon, and client_lat in the events as fields? </P> <P>I would like to map these events without generating a lookup table.</P> Mon, 28 Sep 2020 09:47:34 GMT https://community.splunk.com/t5/Splunk-Search/use-amMap-without-a-lookup/m-p/55489#M13551 nate015 2020-09-28T09:47:34Z https://community.splunk.com/t5/Splunk-Search/use-amMap-without-a-lookup/m-p/55490#M13552 <P>That will work as well. Whether you use maxmind, a custom CSV, or the search language ... the goal is the same: Make sure mapit has <A href="http://splunk-base.splunk.com/answers/4029/how-do-i-use-the-splunk-for-ammap-app-posted-on-splunkbase">what it needs</A> to plot your data on an amMap. Here is an example of plotting two points exclusively using the search language, sans lookup(s):</P> <PRE><CODE>| stats count | eval count=1000| eval ip="127.0.0.1" | eval client_city="Santa Claus" | eval client_region="IN" | eval client_country="USA" | eval client_lon="-86.913958" | eval client_lat="38.120445" | eval movie_color="#FF0000" | append [| stats count | eval count=100| eval ip="10.0.0.1" | eval client_city="RMS" | eval client_region="Titanic" | eval client_country="Atlantic" | eval client_lon=-41 | eval client_lat=49 | eval movie_color="#8b8b8b"] | eval iterator="ip" | eval iterator_label="match or IP" | eval count_label="count" | eval output_file="home_threat_data.xml" | eval app="amMap" | mapit </CODE></PRE> Thu, 23 Feb 2012 15:12:47 GMT https://community.splunk.com/t5/Splunk-Search/use-amMap-without-a-lookup/m-p/55490#M13552 bwooden 2012-02-23T15:12:47Z