topic Re: Geostats display values on map? in Splunk Search

Geostats display values on map?

sc0tt — Sat, 12 Oct 2013 19:57:29 GMT

I've started exploring geostats in Splunk 6. Is it possible to display labels/values on a map instead of a pie chart? I would like to use this on a live dashboard so seeing the values would be helpful.

Re: Geostats display values on map?

iKate — Mon, 14 Oct 2013 17:01:32 GMT

Seems that better decision for this now is old good Google Maps app http://apps.splunk.com/app/368/#versionBox

Also what dissapointed me with new inbuilt maps that latitude and longitude are not defined from ipaddress field and that visualization is supported just in simple xml (or it's not covered in docs).

Re: Geostats display values on map?

arahut_splunk — Mon, 28 Sep 2020 14:57:46 GMT

here are a few lines of example xml to create a
map dashboard and to get latitude, longitude for ipaddress.
(assuming you have events of sourcetype, access_combined_wcookie)

MyMap

sourcetype = access_combined_wcookie | iplocation clientip | geostats count by clientip

Re: Geostats display values on map?

ChrisG — Mon, 14 Oct 2013 19:58:55 GMT

There is no attribute in the Splunk 6.0 simple xml to apply labels to your map markers; hoping for this enhancement in a future release.

Re: Geostats display values on map?

iKate — Tue, 15 Oct 2013 10:46:48 GMT

thanks! I was misled with description of iplocation command in documentation where were no mention of latitude or longitude:

"The IP address field, specified in ip-address-fieldname, is looked up in a database and location fields information is added to the event. The fields are country, city, metroCode, areaCode, region, postalCode."

Re: Geostats display values on map?

arahut_splunk — Tue, 15 Oct 2013 21:23:25 GMT

thanks for catching the error in the documentation.
We will rectify this asap.

Re: Geostats display values on map?

ChrisG — Wed, 16 Oct 2013 15:19:13 GMT

Docs are updated, thanks!

Re: Geostats display values on map?

iKate — Wed, 16 Oct 2013 19:11:31 GMT

@ChrisG guys you are great! I really love Splunk and its documentation!:)

Re: Geostats display values on map?

sc0tt — Thu, 17 Oct 2013 08:16:33 GMT

Thanks. I'll look into the Google Maps app. I also agree that it is disappointing that built-in map is only supported in simple xml.

Re: Geostats display values on map?

sc0tt — Thu, 17 Oct 2013 08:17:44 GMT

Thanks. Here's hoping.

Re: Geostats display values on map?

mikaelbje — Thu, 17 Oct 2013 12:26:15 GMT

I'm also interested in this. I hope it'll be considered.

Re: Geostats display values on map?

adewinter — Thu, 14 Nov 2013 16:42:09 GMT

I would love to see this. Do we know if Splunk is working on an enhancement for the maps element?

Re: Geostats display values on map?

Venkat_16 — Thu, 21 May 2015 12:48:02 GMT

Here is way to add labels to your markes in map, for example You can eliminate longitiude and latitude thing which is displayed in the markes and hard code other stuff like percentage or count... all you have to do is upload it in a .CSS file and save it in the app.

Below i have removed lat n long fields and added percentage field which will be displayed in map

div.leaflet-popup-content tr:first-child {
display: none;
}
div.leaflet-popup-content tr:nth-child(2) {
display: none;
}
div.leaflet-popup-content tr:nth-child(3):after {
content: "%";

Re: Geostats display values on map?

meenuvn — Tue, 24 May 2016 18:58:16 GMT

Hi Venkat_16,
I'm trying to use your code to hide lat/long values and display some other values which are part of geostats.
hiding lat/long works well. but didnt understand correctly how to add a value. Do we need to provide the field value with content: " "