All Apps and Add-ons

Clustered Single Value Map Visualization: How to load marker popups automatically even when clustering is enabled?

bushido5963
New Member

My search is as follows :

| fillnull 

| eval FirewallDown = case(in < out, "maybe", in > out, "true", in == out, "false")

| eval VPNDown = if(in == out AND out ==0, "true", "false")   

| eval markerColor = case(like(FirewallDown, "%true%"), "red", like(FirewallDown, "%maybe%"), "orange", like(VPNDown,"%true%"), "red"), icon=case(like(FirewallDown, "%true%"), "exclamation-circle", like(FirewallDown, "%maybe%"), "exclamation-triangle", like(VPNDown, "%true%"), "server"), 
 description= case( like(FirewallDown, "%true%"),"<b>Firewall is down!</b>"+ "<p>Source IP:"+ src+" + "</p><p>Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>", like(FirewallDown,"%maybe%"),"<b>Firewall maybe down, please check</b>"+ "<p>Source IP:"+ src+"&lt;br/&gt;" + "</p><p>Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>", like(VPNDown, "%true%"),"<b>VPN Tunnel Anomaly!!</b>"+ "<p>Source IP:"+ src+"" + "Destination IP:"+ dst +"Packets in: "+in+" Packets out: "+out+ "</p>") 

|table eventId, latitude, longitude, description, icon, markerColor,FirewallDown, VPNDown, in, out, categoryDeviceGroup, categoryOutcome, deviceDomain, src, shost, sourceTranslatedAddress, dst, dhost, destinationTranslatedAddress 

| iplocation dst | iplocation src 
|  where FirewallDown=="true" OR FirewallDown=="maybe" OR VPNDown =="true" 
| rename lat as latitude lon as longitude 
| head 15

I am searching for all devices that may be down, and so far this is working. What I am trying to do now is have each marker show and have its popup window display ( which is showing iP address and status ).

I want the page to load and have each window be open displaying status.

Is it possible to modify the visualization in order to get this done?

Thank you for your time.

Bushido

0 Karma
1 Solution

shaskell_splunk
Splunk Employee
Splunk Employee

It's not possible with clustering enabled. You'll have to disable clustering and select 'Show All Popups' from the clustering menu. It may affect load times for the visualization depending on how many points you're graphing.

View solution in original post

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

It's not possible with clustering enabled. You'll have to disable clustering and select 'Show All Popups' from the clustering menu. It may affect load times for the visualization depending on how many points you're graphing.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...