Splunk Search

How to add several maps to a dashboard?

genesiusj
Builder

Hello,

Trying to add several maps to a dashboard. One map for each continent, except North America.

How do I lock a dashboard panel to only show that continent, and not zoom out to other continents? Here is my SPL. What would be the XML?

 

index IN (linuxevents)
    AND host IN (la1)
    AND source IN (/data/httpd_logs/ssl_access_log)
    AND method IN (GET,POST) 
    AND cidrName!="waf*" 
| dedup jsessionid
| iplocation client_IP 
| search NOT (Country IN ("United States","Canada","Puerto Rico")) 
| geostats latfield=lat longfield=lon count BY host
| geom geo_countries featureIdField="Country"

 

Thanks and God bless,
Genesius

Labels (2)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

I don't believe you can control the pan on a standard Splunk map. Zoom you can limit to a max zoom. 

I don't think this going to be a helpful answer 😞but maps+ on Splunkbase will allow you to use your own tileset for the map, so therefore would probably allow you to limit what each map shows, but then again, maps+ is not about choropleth maps, which is what you appear to be using based on the geom command you're using.

 

 

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...