All Apps and Add-ons

Google Maps Add-on for Splunk Enterprise: How to create a dashboard with results on a map?

kpavan
Path Finder

Hi,

I have installed Google Maps Add-on for Splunk Entperise in Splunk 6.3.2. In the add-on, when I run the search:

index=wineventlog sourcetype=wineventlog:security EventCode=4625 src_ip=* | geoip src_ip....

I am able to see the results in a map. With that result, I created a dashboard, but in the dashboard, I am unable to see the result in a map. It's only giving me the events. How can I achieve getting the results in a map instead of raw events?

Thanks!

Win_Auth_Failure

<panel>
  <map>
    <title>Auth Failure</title>
    <search>
      <query>index=wineventlog sourcetype=wineventlog:security EventCode=4625 src_ip=* | geoip src_ip</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
    </search>
    <option name="mapping.type">marker</option>
    <option name="mapping.choroplethLayer.colorBins">5</option>
    <option name="mapping.choroplethLayer.colorMode">auto</option>
    <option name="mapping.choroplethLayer.maximumColor">0xDB5800</option>
    <option name="mapping.choroplethLayer.minimumColor">0x2F25BA</option>
    <option name="mapping.choroplethLayer.neutralPoint">0</option>
    <option name="mapping.choroplethLayer.shapeOpacity">0.75</option>
    <option name="mapping.choroplethLayer.showBorder">1</option>
    <option name="mapping.data.maxClusters">100</option>
    <option name="mapping.map.center">(0,0)</option>
    <option name="mapping.map.panning">true</option>
    <option name="mapping.map.scrollZoom">1</option>
    <option name="mapping.map.zoom">2</option>
    <option name="mapping.markerLayer.markerMaxSize">50</option>
    <option name="mapping.markerLayer.markerMinSize">10</option>
    <option name="mapping.markerLayer.markerOpacity">0.8</option>
    <option name="mapping.showTiles">1</option>
    <option name="mapping.tileLayer.maxZoom">19</option>
    <option name="mapping.tileLayer.minZoom">0</option>
    <option name="mapping.tileLayer.tileOpacity">1</option>
    <option name="drilldown">all</option>
    <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
  </map>
</panel>
0 Karma

woodcock
Esteemed Legend

Try this:

index=wineventlog sourcetype=wineventlog:security EventCode=4625 | stats count BY src_ip | geoip src_ip

Or maybe:

index=wineventlog sourcetype=wineventlog:security EventCode=4625 | stats count BY src_ip | lookup geo src_ip
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...