Alterations to the Google Maps App

[MHibbin]

Hi all,

I was wondering if any one has made any modifications to the way data is represented on in with the Google Maps app.

I have achieved what I need to do using the amMap app, but the requirement is to have specifically with a Google maps representation.

I need to represent the current state of various machines, using a simple traffic light system (i.e. red is bad, green is good). I was wondering if someone had replicated something similar in the Google Maps app, perhaps using the default Google pins (that you see on the Google Maps website).

Another possibility, which I don't think is possible, would be to overlay the amMaps with a google map.

Any thoughts welcome.

Thanks in advance,

MHibbin

[ziegfried · Accepted solution]

If you want to use the cluster icons, this should be doable with a simple CSS tweak, combined with a few conditions in the search.

You can hide the numbers in the displayed cluster icons by including the following CSS snippet:

.GoogleMaps .cluster-icon { color: transparent !important; } 

You can simply drop this line into the appserver/static/application.css of the app you want to use it.

To define the icon-color of a location you'd have to create a synthetic _geo_count value. For example:

... | eval _geo_count=case(status=="bad",500,status=="good",1,1==1,50)

The following ranges are used by default to map to the icon color:

A _geo_count value of

• 0 - 10 = blue
• 11-100 = yellow
• 101-1000 = red
• 1001-10000 = pink
• >10000 = purple

You could also customize this range by providing a parameter in the module:

<param name="overlay.rangeMap">0,1000,100000,10000000,1000000000</param>

[MHibbin]

Additionally, I have it appears the following overlay option does not seem to work in my xml...

<param name="overlay.gridSize">5</param>

[MHibbin]

@ziegfried,

are there any other internal fields (e.g. _geo & _geo_count) that can be modified from the search syntax. Preferably something to modify the grid-size (that defines the grouping of clusters. I would like to have one cluster marker per latlng coordinates.

Is this possible.

Thanks,

Matt

[MHibbin]

thanks again for the help

[MHibbin]

That worked a treat thanks! Are there any bugs with Maps... when it loads on the default zoom the events aren't displayed, until I drag the map around, when they appear...

It does appear with an error when the Map is rendering, but this then disappears, this has happened on a few systems.

[MHibbin]

Sorry I missed the line that answers that question 😞

[ziegfried]

Both should work. Be sure to restart splunkweb and clear the browser cache.

[MHibbin]

thanks for the response Ziegfried,

do I add this to an application.css file in appserver/static or the GoogleMaps.css in in the module directory.