In order to sole this issue, we needed to do the following:
Break the geostats count into multiple series based on the count of firewall connections for each lat./long.
Plot our new series on the map and assign custom colors
The search to accomplish this looked like this:
index=firewall | iplocation clientip | geostats count as TOTAL | eval redCount = if(TOTAL >= 250,TOTAL,0) | eval yellowCount = if((TOTAL >= 100 AND TOTAL < 250),TOTAL,0) | eval greenCount = if(TOTAL < 100,TOTAL,0) | fields - TOTAL
Explanation:
Get the location data for each IP
| iplocation clientip
Count the total number of firewall connections for each lat/long and store the count in a new field called TOTAL
| geostats count as TOTAL
Apply Rangemap...
Create a new field for each lat/long called redCount. If the value of the TOTAL field is greater than or equal to 250, set redCount to the value in the TOTAL field. Otherwise, set it to 0.
| eval redCount = if(TOTAL >= 250,TOTAL,0)
Create a new field for each lat/long called yellowCount. If the value of the TOTAL field is greater than or equal to 100 and less than 250, set yellowCount to the value in the TOTAL field. Otherwise, set it to 0.
| eval yellowCount = if((TOTAL >= 100 AND TOTAL < 250),TOTAL,0)
Create a new field for each lat/long called greenCount. If the value of the TOTAL field is less than 100, set greenCount to the value in the TOTAL field. Otherwise, set it to 0.
| eval greenCount = if(TOTAL < 100,TOTAL,0)
Remove the TOTAL field, as we want to plot the greenCount, yellowCount, and redCount series on our map...not a single total.
| fields - TOTAL
We now have a data set with 6 columns, geobin, latitude, longitude, redCount, yellowCount, and greenCount. The last 3 columns only have a value greater than zero if the total firewall connections (stored in the TOTAL field we removed) for that geobin fell into the corresponding range. This will cause only a single series (redCount, yellowCount, greenCount) to be plotted as a pie chart over a specific location on the map....resulting in a "bubble". The pie chart will grow based on firewall connections because we assigned the TOTAL field value to the appropriate series.
To assign specific colors to the ranges, we can utilize the mapping.fieldColors property of the SimpleXML map.
http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML#map
<option name="mapping.fieldColors">{greenCount:0x6dc066,yellowCount:0xffd700,redCount:0xe60026}</option>
The final result looks like this:
... View more
