Clustered Single Value Map Visualization: How to load marker popups automatically even when clustering is enabled?

[bushido5963]

My search is as follows :

| fillnull 

| eval FirewallDown = case(in < out, "maybe", in > out, "true", in == out, "false")

| eval VPNDown = if(in == out AND out ==0, "true", "false")   

| eval markerColor = case(like(FirewallDown, "%true%"), "red", like(FirewallDown, "%maybe%"), "orange", like(VPNDown,"%true%"), "red"), icon=case(like(FirewallDown, "%true%"), "exclamation-circle", like(FirewallDown, "%maybe%"), "exclamation-triangle", like(VPNDown, "%true%"), "server"), 
 description= case( like(FirewallDown, "%true%"),"<b>Firewall is down!</b>"+ "<p>Source IP:"+ src+" + "</p><p>Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>", like(FirewallDown,"%maybe%"),"<b>Firewall maybe down, please check</b>"+ "<p>Source IP:"+ src+"&lt;br/&gt;" + "</p><p>Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>", like(VPNDown, "%true%"),"<b>VPN Tunnel Anomaly!!</b>"+ "<p>Source IP:"+ src+"" + "Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>") 

|table eventId, latitude, longitude, description, icon, markerColor,FirewallDown, VPNDown, in, out, categoryDeviceGroup, categoryOutcome, deviceDomain, src, shost, sourceTranslatedAddress, dst, dhost, destinationTranslatedAddress 

| iplocation dst | iplocation src 
|  where FirewallDown=="true" OR FirewallDown=="maybe" OR VPNDown =="true" 
| rename lat as latitude lon as longitude 
| head 15

I am searching for all devices that may be down, and so far this is working. What I am trying to do now is have each marker show and have its popup window display ( which is showing iP address and status ).

I want the page to load and have each window be open displaying status.

Is it possible to modify the visualization in order to get this done?

Thank you for your time.

Bushido

[shaskell_splunk · Accepted solution]

It's not possible with clustering enabled. You'll have to disable clustering and select 'Show All Popups' from the clustering menu. It may affect load times for the visualization depending on how many points you're graphing.