Dashboards & Visualizations

How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude?

richnsanders_70
Path Finder

I have multiple columns:

source address: saddr
dest address: daddr
times seen: times_seen
destination port: dport
latitude: slat
longitude: slong

My report data is presented as:

saddr  daddr  dport  times_seen slat slong

saddr  daddr  0      12         lat  long  
saddr  daddr  1      22         lat  long  
saddr  daddr  0      15         lat  long  
saddr  daddr  1      7          lat  long  

I'd like to see on my geostats map each dport and how many times it was seen by lat and long on the bubble. I'm getting everything working except for the addition of the "times_seen" block. Anytime I try to evaluate or add the "times_seen" I either get no results or an error.

I'm using:

index="the_index" | geostats latitude=slat longitude=slong count by dport
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport

richnsanders_70
Path Finder

I appreciate the answer, but this combines all my ports into one value, I'd like to see the bubble show me how many of EACH port at each lat/long. What I'm already using shows me in the bubble the ports it sees, but if it sees port 0 three times, once with 17 hits, once with 10 hits and once with 5 hits, it does not appear to combine the values and show port 0 with 32 hits. Thanks again!

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport

richnsanders_70
Path Finder

That seems to have done it, I was going way overboard in trying to solve this when it was such as simple answer.

Thank you very much!

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Any time! Feel free to upvote 🙂

0 Karma

richnsanders_70
Path Finder

I did, i think!

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

thank you!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...