Map on splunk 6

[wragabrr]

Is there a way to use the google map app or something similar in splunk 6?
I have syslogs containing latitude and longitude which I would like to display on a map.

[paramagurukarth]

If you want to display a map.. you can use simple xml's map element....
But if you want to display a map inside advanced xml.. there is no direct way to achieve it...
A Work Around is there...
You can create a map dashboard using simple xml and load its url inside your advanced xml using iframeInclue module
and attach a css to your simple xml map module with below classes
body, td {
min-width: 0 !important;
font-family: Arial,Helvetica,sans-serif !important;
}

Refernce for IframeInclude - http://docs.splunk.com/Documentation/Splunk/6.2.0/AdvancedDev/UseHTML

[khyoung7410]

Hi
Can I change color of the base Splunk 6 default map?
If possible, how can i change this?

[paramagurukarth]

Change the color means.. Do you want to change the tiles..
If you want to change the tile please refer...

 <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
   <option name="mapping.tileLayer.subdomains">[a,b,c]</option>
   <option name="mapping.tileLayer.maxZoom">18</option>

In

http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map

if you want to change the plot colors..
please refer mapping.seriesColors in the same URL

[khyoung7410]

Yes I want to change the tiles color. But not change..
Please show me example

[paramagurukarth]

Add these properties to your map tag

<map>
   <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
   <option name="mapping.tileLayer.subdomains">[a,b,c]</option>
   <option name="mapping.tileLayer.maxZoom">18</option>
   <option name="mapping.tileLayer.attribution">
     Map data (c) 2012 OpenStreetMap contributors, CC-BY-SA.
   </option>
</map>

You can get different layers URl from this site
http://wiki.openstreetmap.org/wiki/OpenLayers

[pietervi]

Hi,

I've created a new app that provides a couple more map visualizations options then the built in splunk ones.
It can do marker maps and cluster maps (similar to the ones existing in Splunk).

But it can also do heat maps and "shape" maps.

See: https://apps.splunk.com/app/1887/

You'll find more screenshots here: https://github.com/pvanisacker/heremaps/tree/master/appserver/static

The app is still in early state of development so if you spot any issues, let me know. And the app only supports 6.1 for now.

[mcronkrite]

Here is an example of mapping Blue Coat Dest IP Location to a Splunk 6 native map using the Splunk CIM Web data model.

 <row>
    <panel>
      <map>
        <title>Countries Count by GEOIP</title>
        <searchString>
| pivot Web Web count(Web) AS "Count of Proxy Events"  SPLITROW dest AS dest FILTER Last_Logged_On_User is $userid$   
SORT 100 dest ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 | iplocation dest | table * | geostats count by dest 
        </searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">all</option>
        <option name="count">10</option>
        <option name="mapping.data.maxClusters">100</option>
        <option name="mapping.map.center">(0,0)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.markerLayer.markerMaxSize">50</option>
        <option name="mapping.markerLayer.markerMinSize">10</option>
        <option name="mapping.markerLayer.markerOpacity">0.8</option>
        <option name="mapping.tileLayer.maxZoom">7</option>
        <option name="mapping.tileLayer.minZoom">0</option>
      </map>
    </panel>
  </row>

[Linegod]

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Visualizationreference#Maps

[wragabrr]

This looks promising. Thank you!