Splunk Search

Using some besides Count in Google Maps

hgran
Explorer

Hello,

We have some google map geo-visualizations setup that uses event count by location. I was wondering if it is possible to use other numeric fields by location(e.g., session duration or bytes).

Thank you,

Henry

Tags (2)
1 Solution

ziegfried
Influencer

Yes, you can populate the field _geo_count manually. This value will be summed for each distinct (or merged) location and displayed in the marker.

Example:

sourcetype=access_combined | geoip clientip | stats sum(bytes) as _geo_count by _geo

View solution in original post

ziegfried
Influencer

Yes, you can populate the field _geo_count manually. This value will be summed for each distinct (or merged) location and displayed in the marker.

Example:

sourcetype=access_combined | geoip clientip | stats sum(bytes) as _geo_count by _geo

hgran
Explorer

Thanks that worked great!

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...