Splunk Search

My values are not showing on map

bryso25
New Member

Hello, Im very new with Splunk. Can you please tell me what is missing on my search string

eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields - percent |geom geo_countries featureIdField=count

I need to show the values on my map however it is showing blank and no colors. Please help.

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To plot results on a map, the events need to contain latitude and longitude, which your query appears to be missing. Add those fields to your query, if you have them. If you don't have those fields, you can use the iplocation command to derive latitude and longitude from an IP address. Then use geostats to plot the results.

eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields - percent | iplocation foo | geostats count by Site
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

493669
Super Champion
eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields count Site |geom geo_countries featureIdField=Site

Use featureIdField as Site

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To plot results on a map, the events need to contain latitude and longitude, which your query appears to be missing. Add those fields to your query, if you have them. If you don't have those fields, you can use the iplocation command to derive latitude and longitude from an IP address. Then use geostats to plot the results.

eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields - percent | iplocation foo | geostats count by Site
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...