All Apps and Add-ons

Clustered Single Value Map Visualization: How to load marker popups automatically even when clustering is enabled?

bushido5963
New Member

My search is as follows :

| fillnull 

| eval FirewallDown = case(in < out, "maybe", in > out, "true", in == out, "false")

| eval VPNDown = if(in == out AND out ==0, "true", "false")   

| eval markerColor = case(like(FirewallDown, "%true%"), "red", like(FirewallDown, "%maybe%"), "orange", like(VPNDown,"%true%"), "red"), icon=case(like(FirewallDown, "%true%"), "exclamation-circle", like(FirewallDown, "%maybe%"), "exclamation-triangle", like(VPNDown, "%true%"), "server"), 
 description= case( like(FirewallDown, "%true%"),"<b>Firewall is down!</b>"+ "<p>Source IP:"+ src+" + "</p><p>Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>", like(FirewallDown,"%maybe%"),"<b>Firewall maybe down, please check</b>"+ "<p>Source IP:"+ src+"&lt;br/&gt;" + "</p><p>Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>", like(VPNDown, "%true%"),"<b>VPN Tunnel Anomaly!!</b>"+ "<p>Source IP:"+ src+"" + "Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>") 

|table eventId, latitude, longitude, description, icon, markerColor,FirewallDown, VPNDown, in, out, categoryDeviceGroup, categoryOutcome, deviceDomain, src, shost, sourceTranslatedAddress, dst, dhost, destinationTranslatedAddress 

| iplocation dst | iplocation src 
|  where FirewallDown=="true" OR FirewallDown=="maybe" OR VPNDown =="true" 
| rename lat as latitude lon as longitude 
| head 15

I am searching for all devices that may be down, and so far this is working. What I am trying to do now is have each marker show and have its popup window display ( which is showing iP address and status ).

I want the page to load and have each window be open displaying status.

Is it possible to modify the visualization in order to get this done?

Thank you for your time.

Bushido

0 Karma
1 Solution

shaskell_splunk
Splunk Employee
Splunk Employee

It's not possible with clustering enabled. You'll have to disable clustering and select 'Show All Popups' from the clustering menu. It may affect load times for the visualization depending on how many points you're graphing.

View solution in original post

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

It's not possible with clustering enabled. You'll have to disable clustering and select 'Show All Popups' from the clustering menu. It may affect load times for the visualization depending on how many points you're graphing.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...