Splunk Search

How do I use the built-in maps in Splunk to plot the different countries in my search results and display the counts on each country?

rana_nour
Explorer
 index=gasf uri_path="*.aspx"  (( eventtype="Hub" ) AND eventtype=*)   | iplocation clientip | timechart span=1hr c by Country limit=400 usenull=f

Here is my search. It displays the number of hits done on each country in a normal timechart. My question here is how to use the built-in maps to plot the different countries and display the different number of counts on each country. Any guidance here?

Tags (3)
0 Karma

tom_frotscher
Builder

Hi,

instead of timechart use this:

index=gasf uri_path=".aspx" (( eventtype="Hub" ) AND eventtype=) | iplocation clientip | geostats count by Country

Then adjust the search to your needs. The geostats command does not work by country, it works by lat and lon fields. Therefore it might be usefull to create a list that matches a country to fixed lat and lon values in your case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...