Help understanding Google Maps results

[soundchaos]

I need to be able to get useful data out of the following search:

index="logs" source="mywebsite" | stats dc(cs_username) as Users by c_ip | where Users > 4 | geoip c_ip


The search (in theory) should show me a location where a single IP address has more than 4 users. What I can't see is the actual IP address, and numbers in the circles don't make any sense, I would like the number to be how many users there are, and I would like to be able to click on, hover over, or have some way to easily see the IP address. As it stands, I have no way to see the IP address without doing a completely separate search without geoip

edit: Right now, if I do click on one of the results, it puts the search in a new window and adds _geo="43.6135,-116.2035" to the parameters, but it always gives me "No results found."

[martin_mueller · Accepted solution]

You could try out Splunk 6's built-in geolocation and mapping capabilities.

index=logs source=mywebsite | stats dc(cs_username) as Users by c_ip | where Users > 4 | iplocation c_ip | geostats count by c_ip

Set the visualization to Map in the UI (6.1) or in SimpleXML source (6.0).

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/iplocation
http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/geostats

[martin_mueller]

If your problem is any different from this question then please create a new question.

If your problem is the same then just use the answer above and adapt to your field names.

[splunkn]

martin_mueller am having user id and src_ip. how i could display the top 10 users in map? any ideas

[martin_mueller]

Yeah, my search counts the stats results by c_ip, which will always give you one. You can use different geostats functions, such as sum(Users) by c_ip depending on what you want.

[soundchaos]

This is the first time I have got the built in one to give me any results! Thank you! Now my problem with it is that the count is not working, it shows 1 count for every IP now.