Custom Cluster Map Visualization: Why is the app not displaying the correct count per cluster nor does it drilldown for a larger cluster number?

[rbardonetorian]

All,

I have been trying to get this Custom Cluster Map Visualization app to work properly. So far I can see clusters with small number that represent a count comprised of the general lat/lon. When a cluster goes above "1", I can not drilldown like all the other clusters allow me to do. Could someone shed some light? Thank you!!

  <row>
    <panel>
      <title>T</title>
      <viz type="viz_clustermap.clustermap">
        <search>
          <query>index="index" sourcetype="T" dest_ip="*" | head 10000 | iplocation dest_ip | geostats latfield=lat longfield=lon count by dest_ip | sort-count</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="height">600</option>
        <option name="refresh.display">none</option>
        <option name="viz_clustermap.clustermap.drilldown">all</option>
        <option name="viz_clustermap.clustermap.lat">30.032974</option>
        <option name="viz_clustermap.clustermap.lng">-5.546875</option>
        <option name="viz_clustermap.clustermap.markerColor1">#ff0000</option>
        <option name="viz_clustermap.clustermap.markerColor2">#ff0000</option>
        <option name="viz_clustermap.clustermap.markerColor3">#ff0000</option>
        <option name="viz_clustermap.clustermap.markerColor4">#ff0000</option>
        <option name="viz_clustermap.clustermap.maxClusters">791</option>
        <option name="viz_clustermap.clustermap.numberFormat_min_0">0.[0]</option>
        <option name="viz_clustermap.clustermap.numberFormat_min_1000">1.1a</option>
        <option name="viz_clustermap.clustermap.numberFormat_min_10000">1a</option>
        <option name="viz_clustermap.clustermap.numberFormat_min_1000000">1.1a</option>
        <option name="viz_clustermap.clustermap.size">36</option>
        <option name="viz_clustermap.clustermap.tiles">dark</option>
        <option name="viz_clustermap.clustermap.tiles_max_zoom">18</option>
        <option name="viz_clustermap.clustermap.tiles_min_zoom">0</option>
        <option name="viz_clustermap.clustermap.tiles_url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
        <option name="viz_clustermap.clustermap.zoom">3</option>
        <drilldown>
          <set token="map.click.lat">$click.lat.value$</set>
          <set token="map.click.lon">$click.lon.value$</set>
        </drilldown>
      </viz>
    </panel>
  </row>
  <row>

Enterprise 6.5
Chrome Browser

[ziegfried]

The custom cluster map does not support results split-by a field. You'll have to remove ... by dest_ip part from geostats)

[rbardonetorian]

PS. if anyone can tell me where to find a legend / definition to what all the options are for this app, it would be a great way for extra points. Thx!! 😉