All,
I have been trying to get this Custom Cluster Map Visualization app to work properly. So far I can see clusters with small number that represent a count comprised of the general lat/lon. When a cluster goes above "1", I can not drilldown like all the other clusters allow me to do. Could someone shed some light? Thank you!!
<row>
<panel>
<title>T</title>
<viz type="viz_clustermap.clustermap">
<search>
<query>index="index" sourcetype="T" dest_ip="*" | head 10000 | iplocation dest_ip | geostats latfield=lat longfield=lon count by dest_ip | sort-count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="height">600</option>
<option name="refresh.display">none</option>
<option name="viz_clustermap.clustermap.drilldown">all</option>
<option name="viz_clustermap.clustermap.lat">30.032974</option>
<option name="viz_clustermap.clustermap.lng">-5.546875</option>
<option name="viz_clustermap.clustermap.markerColor1">#ff0000</option>
<option name="viz_clustermap.clustermap.markerColor2">#ff0000</option>
<option name="viz_clustermap.clustermap.markerColor3">#ff0000</option>
<option name="viz_clustermap.clustermap.markerColor4">#ff0000</option>
<option name="viz_clustermap.clustermap.maxClusters">791</option>
<option name="viz_clustermap.clustermap.numberFormat_min_0">0.[0]</option>
<option name="viz_clustermap.clustermap.numberFormat_min_1000">1.1a</option>
<option name="viz_clustermap.clustermap.numberFormat_min_10000">1a</option>
<option name="viz_clustermap.clustermap.numberFormat_min_1000000">1.1a</option>
<option name="viz_clustermap.clustermap.size">36</option>
<option name="viz_clustermap.clustermap.tiles">dark</option>
<option name="viz_clustermap.clustermap.tiles_max_zoom">18</option>
<option name="viz_clustermap.clustermap.tiles_min_zoom">0</option>
<option name="viz_clustermap.clustermap.tiles_url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
<option name="viz_clustermap.clustermap.zoom">3</option>
<drilldown>
<set token="map.click.lat">$click.lat.value$</set>
<set token="map.click.lon">$click.lon.value$</set>
</drilldown>
</viz>
</panel>
</row>
<row>
Enterprise 6.5
Chrome Browser
The custom cluster map does not support results split-by a field. You'll have to remove ... by dest_ip
part from geostats)
PS. if anyone can tell me where to find a legend / definition to what all the options are for this app, it would be a great way for extra points. Thx!! 😉