Cluster map

[gjhaaland]

Hi,

I  have created a Cluster Map that show number of counts  based on number of ASA blocked actions.  The circle size is based on number of hits. A bigger circle represent more counts than a small circle.  So far so good. It looks ok, but would be even better if I could change color based on number of counts/hits. 

Is it also possible change color based on destination portnumber (80,23,22++) 

Thanks 

Geir

[gjhaaland]

Thanks 

[bowesmana]

If you want to get a lot of flexibility with maps, then use the maps+ vizualisation

https://splunkbase.splunk.com/app/3124

You have a number of options for defining colour by adding your colour values to the rows of your results

[gjhaaland]

Hi,

Thanks.  I have installed the image but it looks some difficult to use it.  Is it possible to get manual or description how to use it? 

Rgds

Geir

[bowesmana · Accepted solution]

In the Splunkbase site details tab there is a link to the github documentation

https://github.com/sghaskell/maps-plus

Also, there are lots of examples in the app itself, so you can look at those searches to see how they are producing things.