Dashboards & Visualizations

Can you add a map (either AMMAP or GoogleMap) on an existing Dashboard

BunnyHop
Contributor

Is this possible? I would like to add either AMMAP or Google Maps on an existing main dashboard for a custom app.

0 Karma
1 Solution

ziegfried
Influencer

Yes, this is possible with both mapping solutions although the way you implement it is quite different. I can give you an example on how to embed the Google Maps module in your custom dashboard. This is a snippet for the advanced XML, you could use (the Google Maps app has to be installed):

<module name="HiddenSearch" group="Map View" autoRun="True" layout_panel="panel_row1_col1">
    <param name="search">sourcetype=access_combined NOT clientip=10.* NOT clientip=192.168.* | geoip clientip | genormalize | stats count as _geo_count by _lat,_lng</param>
    <module name="GoogleMaps">
        <param name="autoPostProcess">false</param>
        <param name="height">350</param>
        <param name="mapType">terrain</param>
        <param name="mapTypeControl">on</param>
        <param name="navigationControl">on</param>
        <param name="scaleControl">on</param>
        <param name="scrollwheel">off</param>
    </module>
</module>

There's some info on how to embed AMMAP in your custom dashboard in the Splunk Documentation: http://www.splunk.com/base/Documentation/latest/Developer/CreateMap

View solution in original post

ziegfried
Influencer

Yes, this is possible with both mapping solutions although the way you implement it is quite different. I can give you an example on how to embed the Google Maps module in your custom dashboard. This is a snippet for the advanced XML, you could use (the Google Maps app has to be installed):

<module name="HiddenSearch" group="Map View" autoRun="True" layout_panel="panel_row1_col1">
    <param name="search">sourcetype=access_combined NOT clientip=10.* NOT clientip=192.168.* | geoip clientip | genormalize | stats count as _geo_count by _lat,_lng</param>
    <module name="GoogleMaps">
        <param name="autoPostProcess">false</param>
        <param name="height">350</param>
        <param name="mapType">terrain</param>
        <param name="mapTypeControl">on</param>
        <param name="navigationControl">on</param>
        <param name="scaleControl">on</param>
        <param name="scrollwheel">off</param>
    </module>
</module>

There's some info on how to embed AMMAP in your custom dashboard in the Splunk Documentation: http://www.splunk.com/base/Documentation/latest/Developer/CreateMap

ziegfried
Influencer

No, typo 😉 Glad that it works 🙂

0 Karma

BunnyHop
Contributor

Awesome! Just changed the layout_panel settings to layoutPanel (deprecated format?) and I'm good to go! Tnx!

0 Karma

ziegfried
Influencer

Yes, you'll need to convert it to advanced XML. The link in my comment above should help you doing this. There's no way to use custom modules in simple XML yet.

0 Karma

BunnyHop
Contributor

I do have that, and my main dashboard (which if I'm correct) is built as Simple XML. How do I include the Advanced XML config to the Simple? Or do I have to completely rehaul my custom dashboard to an Advanced XML format?

0 Karma

ziegfried
Influencer

The Maps view is showing because it is configured as globally visible in the maps app. You'll have to edit the XML of your default view/dashboard (which has to exist in the data/ui/views folder). If you don't have a default view yet, you need to create it and link it as default from your navigation - See the Developer Docs for more info. If it's not already advanced XML, you'll have to convert it. See http://answers.splunk.com/questions/1/how-can-i-convert-simple-view-xml-to-advanced-xml

0 Karma

BunnyHop
Contributor

By the way, just for clarification, Google Maps is already showing in the app, and that it is within the Nav under Views, but I would like for it to be a part of the main Dashboard.

0 Karma

BunnyHop
Contributor

Forgive my ignorance, but do you add this to your default view or you create this as an XML within the views folder and then reference it on the nav?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...