Hello, I am trying to use one cluster map to visualize the locations of a user's source and destination IPs for Duo logs. Currently, I have two separate cluster maps for each. Source IP Address Query: index="duo" extracted_eventtype=authentication_v2 user.name="$user.name$" access_device.ip!="NULL" | iplocation access_device.ip | geostats count by City Destination IP Address Query: index="duo" extracted_eventtype=authentication_v2 user.name="$user.name$" auth_device.ip!="NULL" | iplocation auth_device.ip | geostats count by City I'm somewhat new to visualizations and dashboarding, and was hoping for some assistance on writing a combined query that would display both source and destination IPs on a cluster map.
... View more