All Apps and Add-ons

Clustered Single Value Map Visualization: How can I define layers so that the user can choose whether or not to display each layer?

dxwils3
Explorer

I've got a map with different types of sites. I'd like to group these into layers so that the user can use the layer control on the right to hide or show the different types of sites. Is there some field that I need to set to make this possible?

0 Karma
1 Solution

shaskell_splunk
Splunk Employee
Splunk Employee

In the latest version of Clustered Single Value Map Visualization (1.5.9) you can control the layers using a field in SPL called layerGroup. You can pair that with the layerDescription field to control the text displayed in the layer filter display.

Older versions of the app would create layer filters based on the icons used in your markers. It keyed off the icon field and if you didn't assign any custom icons to your markers, it would just lump them all into the circle icon giving you a single layer.

You can see details here.

https://github.com/sghaskell/Clustered-Single-Value-Map-Visualization/issues/13

View solution in original post

shaskell_splunk
Splunk Employee
Splunk Employee

In the latest version of Clustered Single Value Map Visualization (1.5.9) you can control the layers using a field in SPL called layerGroup. You can pair that with the layerDescription field to control the text displayed in the layer filter display.

Older versions of the app would create layer filters based on the icons used in your markers. It keyed off the icon field and if you didn't assign any custom icons to your markers, it would just lump them all into the circle icon giving you a single layer.

You can see details here.

https://github.com/sghaskell/Clustered-Single-Value-Map-Visualization/issues/13

niketnilay
Legend

@dxwils3, you can add a Radio Input to your Dashboard and set specific panel display token based on which option is selected in the Radio button (at the same time unset the tokens for remaining panel/s). Using depends attribute you can show only specific panel for which the token is set.

PS: There is a possibility based on your existing query for various maps that only single search can be run based on Selected Radio option, hence reducing the load on your Dashboard when it loads/refreshes. However, you would need to provide your existing query to see if specific part of query needs to be set dynamically through token or set the entire Query to be run based on Radio option selection.

Following is a run anywhere dashboard based on Splunk's geomaps_data.csv file to dummy/test Map visualization:

1) CSS Style override has been applied for Panels with Map to cover 80% of row and Radio input Panel to occupy 20%.
2) Row with CSS Style is always hidden using a token $alwaysHideCSSStyle$ with depends which is never set.
3) Panels with maps with id panelMethod and panelStatushave been created with depends tokens $showPanelMethod$ and
$showPanelStatus$ respectively, to display the panel only when specific token is set.
4) Radio input has been added to a panel with id panelOptions with change event handler for setting the token for selected option and unsetting token for remaining option/s.

alt text

<form>
  <label>Map with multiple selection</label>
  <fieldset submitButton="false"></fieldset>
  <row depends="$alwaysHideCSSStyle$">
    <panel>
      <html>
        <style>
          div#panelMethod{
            width:80% !important;
          }
          div#panelStatus{
            width:80% !important;
          }
          div#panelOptions{
            width:20% !important;
          }
        </style>
    </html>
    </panel>
  </row>
  <row>
    <panel id="panelMethod" depends="$showPanelStatus$">
      <title>Count by Method</title>
      <map>
        <search>
          <query>| inputlookup geomaps_data.csv
|  stats count by device_ip method
| iplocation device_ip
| geostats latfield=lat longfield=lon sum(count) by method</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="mapping.type">marker</option>
        <option name="refresh.display">progressbar</option>
        <option name="mapping.fieldColors">{"GET":0x65a637,"POST":0xd93f3c}</option>
      </map>
    </panel>
    <panel id="panelStatus" depends="$showPanelMethod$">
      <title>Count by Status</title>
      <map>
        <search>
          <query>| inputlookup geomaps_data.csv
|  stats count by device_ip status
| iplocation device_ip
| geostats latfield=lat longfield=lon sum(count) by status</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="mapping.type">marker</option>
        <option name="refresh.display">progressbar</option>
        <option name="mapping.fieldColors">{"200":0x65a637,"503":0xd93f3c}</option>
      </map>
    </panel>
    <panel id="panelOptions">
      <title>Select Option</title>
      <input type="radio" token="tokGeoStats" searchWhenChanged="true">
        <label></label>
        <choice value="method">Count by Method</choice>
        <choice value="status">Count by Status</choice>
        <change>
          <condition value="method">
            <set token="showPanelMethod">true</set>
            <unset token="showPanelStatus"></unset>
          </condition>
          <condition value="status">
            <set token="showPanelStatus">true</set>
            <unset token="showPanelMethod"></unset>
          </condition>
        </change>
        <default>method</default>
      </input>
    </panel>
  </row>
</form>

Please try out and confirm if this fits your needs. Also share existing map queries if you are interested in only keeping single Map visualization and run only one search based on Selected Radio button. The Query can be set in the <change> event handler for Radio input and passed on the Search query (single Panel will exist, so single query).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dxwils3
Explorer

This will indeed do what I need. I was hoping that the Clustered Single Value Map Visualization would have a built-in way to use the layer control on the map, but this will work. Thanks for the help!

0 Karma

niketnilay
Legend

@dxwils3 would it be possible to attached some sample screenshots of what you have in mind or else any link for the behavior that you are expecting.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dxwils3
Explorer

@niketnilay Thanks for following up. I did eventually figure out how to do this in the visualization. The viz groups points into layers based on the value in the icon field (e.g. "circle" or "square") in the final table of statistics. The name of a layer is the value in the layerDescription field for the last point with the given icon.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...