Archive
Highlighted

Map on the dashboard

New Member

I would like to edit the seach that presents the map on the dashboard.

Currently it shows the location of the IPs by security event.

I want to show the same but filtering by destination, for instance, show the location of the IPs that connected to a specific server in our organization.

is that possible?

Ramon

Tags (1)
0 Karma
Highlighted

Re: Map on the dashboard

Motivator

It's definitely possible.

It may, however, take some work.

The ammap tool used in the Cisco app works from a static XML file that gets regenerated periodically in the background by a saved search. You would need to duplicate this functionality for each variation of the map that you want.

If you want to be able to apply filters in realtime, then you're better off converting it to use the Google Maps plugin (see link for how to do that). The Google Maps integration works differently than ammap -- each map is generated at search time for the specific result set, so you have more flexibility.

You can look at the UI Examples app or the docs to see how the XML would work. You'd probably end up wrapping the GoogleMaps module in a SearchSelectLister or similar.

0 Karma
Highlighted

Re: Map on the dashboard

New Member

I added the google maps app, very cool, but it doesnt work for me, it is not showing the results.

I do this search on the google app
eventtype="ciscofirewall" | lookup geoip clientip as srcip | geonormalize
and it doesnt show me any results on the map 😞

Ramon

0 Karma
Highlighted

Re: Map on the dashboard

Motivator

What if you just use: eventtype="ciscofirewall" | geoip srcip

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.