chroplate map and sorting

[raindrop18]

I have this query and I want create chroplate map based on count, I am apperciate if some one give some insight.

my objective is to display failed user name attempt per ip, preferably failed more than 5 times on chroplate map sorted by the ip with highest failed user name.

index=user host=web* "failed user name" | stats count by userip 

[paulbannister]

Hi There,

I'm assuming you are referring to Chloropleth maps, on this you should be able to find most the information on these here:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/ChoroplethGenerate

For yours specifically your going to want to use the iplocation command after your query

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Iplocation