When visualizing results on a map (presumably using geostats, but maybe there's something else?) is there a way to get a small line or area chart instead of a pie chart?
Basically I have a bunch of requests over the past week or month then using iplocation to find where they are coming from. I want to see if there are places with a significantly different number of requests (preferably by http_response_status) one day from the next.
Even more basically, did we get 10K requests from (for example) St. Louis yesterday when over the past week we usually get 500? Did we get 4K 401's from Buffalo when usually they're 3K 200's.
I've tried combining iplocation, geostats, timechart, "bin + chart by _time", etc. in various ways and can't get the data to make sense. Much less to visualize it like I want.
| iplocation ip | bin _time span=1d | stats count by _time, lat, lon, http_response_status
Maybe this is two questions. 1) How to format the data and 2) Can/how to visualize it.
Thank you!
