I've been able to get AmMap to work with scheduled searches. Is there a way to get it to work in realtime? I thought I saw this demonstrated at the splunk live event in Washington DC last week. I've searched without much luck for an answer. The default AmMap app comes with a "Real Time AMMAP view" does anyone know how I put the data into this view. It doesn't appear to be the same file as the scheduled searches/ regular AmMap.
That view should be working, if not, you may want to try an updated build on splunkbase. The setup for this is simple though. Notice the HTML refers to a rt_settings file, you'll need to include that in the HTML you will be pulling in via a ServerSideInclude.