Splunk Search

How to add several maps to a dashboard?



Trying to add several maps to a dashboard. One map for each continent, except North America.

How do I lock a dashboard panel to only show that continent, and not zoom out to other continents? Here is my SPL. What would be the XML?


index IN (linuxevents)
    AND host IN (la1)
    AND source IN (/data/httpd_logs/ssl_access_log)
    AND method IN (GET,POST) 
    AND cidrName!="waf*" 
| dedup jsessionid
| iplocation client_IP 
| search NOT (Country IN ("United States","Canada","Puerto Rico")) 
| geostats latfield=lat longfield=lon count BY host
| geom geo_countries featureIdField="Country"


Thanks and God bless,

Labels (2)
Tags (2)
0 Karma


I don't believe you can control the pan on a standard Splunk map. Zoom you can limit to a max zoom. 

I don't think this going to be a helpful answer 😞but maps+ on Splunkbase will allow you to use your own tileset for the map, so therefore would probably allow you to limit what each map shows, but then again, maps+ is not about choropleth maps, which is what you appear to be using based on the geom command you're using.



0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!