Splunk Search
Highlighted

Geostats display values on map?

Builder

I've started exploring geostats in Splunk 6. Is it possible to display labels/values on a map instead of a pie chart? I would like to use this on a live dashboard so seeing the values would be helpful.

Tags (3)
Highlighted

Re: Geostats display values on map?

Builder

Seems that better decision for this now is old good Google Maps app http://apps.splunk.com/app/368/#versionBox
alt text

Also what dissapointed me with new inbuilt maps that latitude and longitude are not defined from ipaddress field and that visualization is supported just in simple xml (or it's not covered in docs).

View solution in original post

Highlighted

Re: Geostats display values on map?

Splunk Employee
Splunk Employee

here are a few lines of example xml to create a
map dashboard and to get latitude, longitude for ipaddress.
(assuming you have events of sourcetype, accesscombinedwcookie)





sourcetype = accesscombinedwcookie | iplocation clientip | geostats count by clientip



Highlighted

Re: Geostats display values on map?

Builder

thanks! I was misled with description of iplocation command in documentation where were no mention of latitude or longitude:

"The IP address field, specified in ip-address-fieldname, is looked up in a database and location fields information is added to the event. The fields are country, city, metroCode, areaCode, region, postalCode."

Highlighted

Re: Geostats display values on map?

Splunk Employee
Splunk Employee

thanks for catching the error in the documentation.
We will rectify this asap.

Highlighted

Re: Geostats display values on map?

Splunk Employee
Splunk Employee

Docs are updated, thanks!

Highlighted

Re: Geostats display values on map?

Builder

@ChrisG guys you are great! I really love Splunk and its documentation!:)

0 Karma
Highlighted

Re: Geostats display values on map?

Builder

Thanks. I'll look into the Google Maps app. I also agree that it is disappointing that built-in map is only supported in simple xml.

0 Karma
Highlighted

Re: Geostats display values on map?

Splunk Employee
Splunk Employee

There is no attribute in the Splunk 6.0 simple xml to apply labels to your map markers; hoping for this enhancement in a future release.

Highlighted

Re: Geostats display values on map?

Builder

Thanks. Here's hoping.

0 Karma