Splunk Search

How to add several maps to a dashboard?

genesiusj
Builder

Hello,

Trying to add several maps to a dashboard. One map for each continent, except North America.

How do I lock a dashboard panel to only show that continent, and not zoom out to other continents? Here is my SPL. What would be the XML?

 

index IN (linuxevents)
    AND host IN (la1)
    AND source IN (/data/httpd_logs/ssl_access_log)
    AND method IN (GET,POST) 
    AND cidrName!="waf*" 
| dedup jsessionid
| iplocation client_IP 
| search NOT (Country IN ("United States","Canada","Puerto Rico")) 
| geostats latfield=lat longfield=lon count BY host
| geom geo_countries featureIdField="Country"

 

Thanks and God bless,
Genesius

Labels (2)
Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

I don't believe you can control the pan on a standard Splunk map. Zoom you can limit to a max zoom. 

I don't think this going to be a helpful answer 😞but maps+ on Splunkbase will allow you to use your own tileset for the map, so therefore would probably allow you to limit what each map shows, but then again, maps+ is not about choropleth maps, which is what you appear to be using based on the geom command you're using.

 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...