topic Re: Map on splunk 6 in Splunk Search

Map on splunk 6

wragabrr — Sat, 12 Oct 2013 12:45:10 GMT

Is there a way to use the google map app or something similar in splunk 6?
I have syslogs containing latitude and longitude which I would like to display on a map.

Re: Map on splunk 6

Linegod — Sat, 12 Oct 2013 14:54:56 GMT

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Visualizationreference#Maps

Re: Map on splunk 6

wragabrr — Sat, 12 Oct 2013 18:30:18 GMT

This looks promising. Thank you!

Re: Map on splunk 6

mcronkrite — Sun, 21 Sep 2014 23:34:34 GMT

Here is an example of mapping Blue Coat Dest IP Location to a Splunk 6 native map using the Splunk CIM Web data model.

 <row>
    <panel>
      <map>
        <title>Countries Count by GEOIP</title>
        <searchString>
| pivot Web Web count(Web) AS "Count of Proxy Events"  SPLITROW dest AS dest FILTER Last_Logged_On_User is $userid$   
SORT 100 dest ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 | iplocation dest | table * | geostats count by dest 
        </searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">all</option>
        <option name="count">10</option>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.map.center">(0,0)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.tileLayer.maxZoom">7</option>
        <option name="mapping.tileLayer.minZoom">0</option>
      </map>
    </panel>
  </row>

Re: Map on splunk 6

pietervi — Mon, 20 Oct 2014 08:48:42 GMT

Hi,

I've created a new app that provides a couple more map visualizations options then the built in splunk ones.
It can do marker maps and cluster maps (similar to the ones existing in Splunk).

But it can also do heat maps and "shape" maps.

See: https://apps.splunk.com/app/1887/

You'll find more screenshots here: https://github.com/pvanisacker/heremaps/tree/master/appserver/static

The app is still in early state of development so if you spot any issues, let me know. And the app only supports 6.1 for now.

Re: Map on splunk 6

paramagurukarth — Fri, 28 Nov 2014 09:35:25 GMT

If you want to display a map.. you can use simple xml's map element....
But if you want to display a map inside advanced xml.. there is no direct way to achieve it...
A Work Around is there...
You can create a map dashboard using simple xml and load its url inside your advanced xml using iframeInclue module
and attach a css to your simple xml map module with below classes
body, td {
min-width: 0 !important;
font-family: Arial,Helvetica,sans-serif !important;
}

Refernce for IframeInclude - http://docs.splunk.com/Documentation/Splunk/6.2.0/AdvancedDev/UseHTML

Re: Map on splunk 6

khyoung7410 — Thu, 20 Aug 2015 02:30:30 GMT

Hi
Can I change color of the base Splunk 6 default map?
If possible, how can i change this?

Re: Map on splunk 6

paramagurukarth — Thu, 20 Aug 2015 09:20:19 GMT

Change the color means.. Do you want to change the tiles..
If you want to change the tile please refer...

 <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
   <option name="mapping.tileLayer.subdomains">[a,b,c]</option>
   <option name="mapping.tileLayer.maxZoom">18</option>

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map

if you want to change the plot colors..
please refer mapping.seriesColors in the same URL

Re: Map on splunk 6

khyoung7410 — Fri, 21 Aug 2015 08:57:24 GMT

Yes I want to change the tiles color. But not change..
Please show me example

Re: Map on splunk 6

paramagurukarth — Fri, 21 Aug 2015 10:05:13 GMT

Add these properties to your map tag

<map>
   <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
   <option name="mapping.tileLayer.subdomains">[a,b,c]</option>
   <option name="mapping.tileLayer.maxZoom">18</option>
   <option name="mapping.tileLayer.attribution">
     Map data (c) 2012 OpenStreetMap contributors, CC-BY-SA.
   </option>
</map>

You can get different layers URl from this site
http://wiki.openstreetmap.org/wiki/OpenLayers