How do I modify my search so that results appear on a map?

[alanbudd]

Good day

I am a new user on Splunk Enterprise and am trying to generate a map from search data.
The guy that developed the original search that I am using is no longer working here and unavailable to ask.

When I run the following search

index=radware host=x.x.x.x action="drop" NOT src="y.y.y.y" NOT src="0.0.0.0" |fields src | stats count as _geo_count by src | geoip src | search _geo=* 

I do get a result set with seemingly valid results

However when I go to the visualization tab I just get a blank map

Going through older reports (stored outside of Splunk as pdfs) the above search returns valid maps.

The fact that I am getting valid results and a blank map indicates to me that the search is not the issue but could be a formatting issue.

Some advice on where to look next would be appreciated.

Thanks

[sundareshr]

Try this

 index=radware host=x.x.x.x action="drop" NOT src="y.y.y.y" NOT src="0.0.0.0" |fields src | stats count as _geo_count by src | geoip src | search _geo=* |  geostats latfield=src_latitude longfield=src_longitude count

[alanbudd]

Thanks that put the bubbles on the map.

This is an image of what the original maps looked like (didn't have enough points to post it on the original question)
I don't find any formating options on the visulation tab that seem to apply. How do I make my map look similar to the orginal?

Thanks again

[sundareshr]

Where did you see this?

[alanbudd]

Going through older reports (stored outside of Splunk as pdfs) the documentation available indicates that the person I took over from used the above search and created these maps directly within Splunk. However, I can't find any info on how they are formated.

[sundareshr]

There must be an app installed in your instance which was used in a dashboard.