Dashboards & Visualizations

How to modify my geostats search to map each destination port field and how many times it was seen by latitude and longitude?

Path Finder

I have multiple columns:

source address: saddr
dest address: daddr
times seen: times_seen
destination port: dport
latitude: slat
longitude: slong

My report data is presented as:

saddr  daddr  dport  times_seen slat slong

saddr  daddr  0      12         lat  long  
saddr  daddr  1      22         lat  long  
saddr  daddr  0      15         lat  long  
saddr  daddr  1      7          lat  long  

I'd like to see on my geostats map each dport and how many times it was seen by lat and long on the bubble. I'm getting everything working except for the addition of the "timesseen" block. Anytime I try to evaluate or add the "timesseen" I either get no results or an error.

I'm using:

index="the_index" | geostats latitude=slat longitude=slong count by dport
0 Karma
1 Solution

Splunk Employee
Splunk Employee

index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport

View solution in original post

Splunk Employee
Splunk Employee

index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport

View solution in original post

Path Finder

I appreciate the answer, but this combines all my ports into one value, I'd like to see the bubble show me how many of EACH port at each lat/long. What I'm already using shows me in the bubble the ports it sees, but if it sees port 0 three times, once with 17 hits, once with 10 hits and once with 5 hits, it does not appear to combine the values and show port 0 with 32 hits. Thanks again!

0 Karma

Splunk Employee
Splunk Employee

index="the_index" | geostats count(dport) latitude=slat longitude=slong by dport

Path Finder

That seems to have done it, I was going way overboard in trying to solve this when it was such as simple answer.

Thank you very much!

0 Karma

Splunk Employee
Splunk Employee

Any time! Feel free to upvote 🙂

0 Karma

Path Finder

I did, i think!

0 Karma

Splunk Employee
Splunk Employee

thank you!

0 Karma