I have multiple columns:
source address: saddr dest address: daddr times seen: times_seen destination port: dport latitude: slat longitude: slong
My report data is presented as:
saddr daddr dport times_seen slat slong saddr daddr 0 12 lat long saddr daddr 1 22 lat long saddr daddr 0 15 lat long saddr daddr 1 7 lat long
I'd like to see on my geostats map each dport and how many times it was seen by lat and long on the bubble. I'm getting everything working except for the addition of the "timesseen" block. Anytime I try to evaluate or add the "timesseen" I either get no results or an error.
index="the_index" | geostats latitude=slat longitude=slong count by dport
I appreciate the answer, but this combines all my ports into one value, I'd like to see the bubble show me how many of EACH port at each lat/long. What I'm already using shows me in the bubble the ports it sees, but if it sees port 0 three times, once with 17 hits, once with 10 hits and once with 5 hits, it does not appear to combine the values and show port 0 with 32 hits. Thanks again!