Archive
Highlighted

My values are not showing on map

New Member

Hello, Im very new with Splunk. Can you please tell me what is missing on my search string

eventtype=security * userType=INT userOrganization="BODI" | top limit=20 userLocation | rename userLocation as Site | fields - percent |geom geo_countries featureIdField=count

I need to show the values on my map however it is showing blank and no colors. Please help.

alt text

0 Karma
Highlighted

Re: My values are not showing on map

SplunkTrust
SplunkTrust

To plot results on a map, the events need to contain latitude and longitude, which your query appears to be missing. Add those fields to your query, if you have them. If you don't have those fields, you can use the iplocation command to derive latitude and longitude from an IP address. Then use geostats to plot the results.

eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields - percent | iplocation foo | geostats count by Site
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: My values are not showing on map

Super Champion
eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields count Site |geom geo_countries featureIdField=Site

Use featureIdField as Site

0 Karma