Splunk Search

How to add several maps to a dashboard?

genesiusj
Builder

Hello,

Trying to add several maps to a dashboard. One map for each continent, except North America.

How do I lock a dashboard panel to only show that continent, and not zoom out to other continents? Here is my SPL. What would be the XML?

 

index IN (linuxevents)
    AND host IN (la1)
    AND source IN (/data/httpd_logs/ssl_access_log)
    AND method IN (GET,POST) 
    AND cidrName!="waf*" 
| dedup jsessionid
| iplocation client_IP 
| search NOT (Country IN ("United States","Canada","Puerto Rico")) 
| geostats latfield=lat longfield=lon count BY host
| geom geo_countries featureIdField="Country"

 

Thanks and God bless,
Genesius

Labels (2)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

I don't believe you can control the pan on a standard Splunk map. Zoom you can limit to a max zoom. 

I don't think this going to be a helpful answer 😞but maps+ on Splunkbase will allow you to use your own tileset for the map, so therefore would probably allow you to limit what each map shows, but then again, maps+ is not about choropleth maps, which is what you appear to be using based on the geom command you're using.

 

 

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...