https://community.splunk.com/t5/Splunk-Search/AmMap-and-realtime/m-p/14290#M1489 <P>I've been able to get AmMap to work with scheduled searches. Is there a way to get it to work in realtime? I thought I saw this demonstrated at the splunk live event in Washington DC last week. I've searched without much luck for an answer. The default AmMap app comes with a "Real Time AMMAP view" does anyone know how I put the data into this view. It doesn't appear to be the same file as the scheduled searches/ regular AmMap.</P> <P>Thanks, Jason</P> Wed, 26 May 2010 21:27:15 GMT jjernigan 2010-05-26T21:27:15Z https://community.splunk.com/t5/Splunk-Search/AmMap-and-realtime/m-p/14290#M1489 <P>I've been able to get AmMap to work with scheduled searches. Is there a way to get it to work in realtime? I thought I saw this demonstrated at the splunk live event in Washington DC last week. I've searched without much luck for an answer. The default AmMap app comes with a "Real Time AMMAP view" does anyone know how I put the data into this view. It doesn't appear to be the same file as the scheduled searches/ regular AmMap.</P> <P>Thanks, Jason</P> Wed, 26 May 2010 21:27:15 GMT https://community.splunk.com/t5/Splunk-Search/AmMap-and-realtime/m-p/14290#M1489 jjernigan 2010-05-26T21:27:15Z https://community.splunk.com/t5/Splunk-Search/AmMap-and-realtime/m-p/14291#M1490 <P>Hi Jason, That view should be working, if not, you may want to try an updated build on splunkbase. The setup for this is simple though. Notice the HTML refers to a rt_settings file, you'll need to include that in the HTML you will be pulling in via a ServerSideInclude.</P> <P>The view XML looks like this:</P> <P> src_ip=* src_ip!=10.* src_ip!=192.* src_ip!=0.0.* | stats count by src_ip | eval count_label="Event" | eval iterator="src_ip" | eval iterator_label="IP" | eval movie_color="#FF0000" | eval output_file="rt_threat_data.xml" | eval app="amMap" | lookup geoip clientip as src_ip | mapit rt rt </P> <P> rt_map.html </P> <P></P> <P>Notice the JobProgressIndicator jammed in there. This is so the real time search actually gets kicked off. Let us know if you need a hand getting this working. </P> Thu, 27 May 2010 11:17:51 GMT https://community.splunk.com/t5/Splunk-Search/AmMap-and-realtime/m-p/14291#M1490 Will_Hayes 2010-05-27T11:17:51Z