Dashboards & Visualizations

Combine timechart and geostats


When visualizing results on a map (presumably using geostats, but maybe there's something else?) is there a way to get a small line or area chart instead of a pie chart?

Basically I have a bunch of requests over the past week or month then using iplocation to find where they are coming from.  I want to see if there are places with a significantly different number of requests (preferably by http_response_status) one day from the next.

Even more basically, did we get 10K requests from (for example) St. Louis yesterday when over the past week we usually get 500?  Did we get 4K 401's from Buffalo when usually they're 3K 200's.


I've tried combining iplocation, geostats, timechart, "bin + chart by _time", etc. in various ways and can't get the data to make sense.  Much less to visualize it like I want.

 | iplocation ip | bin _time span=1d | stats count by _time, lat, lon, http_response_status


Maybe this is two questions.  1) How to format the data and 2) Can/how to visualize it.


Thank you!

Labels (1)
0 Karma


@ScottSusman  you are possibly looking for Location Tracker Custom Visualization or may be Map + for Splunk

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...