Good day
I am a new user on Splunk Enterprise and am trying to generate a map from search data.
The guy that developed the original search that I am using is no longer working here and unavailable to ask.
When I run the following search
index=radware host=x.x.x.x action="drop" NOT src="y.y.y.y" NOT src="0.0.0.0" |fields src | stats count as _geo_count by src | geoip src | search _geo=*
I do get a result set with seemingly valid results
However when I go to the visualization tab I just get a blank map
Going through older reports (stored outside of Splunk as pdfs) the above search returns valid maps.
The fact that I am getting valid results and a blank map indicates to me that the search is not the issue but could be a formatting issue.
Some advice on where to look next would be appreciated.
Thanks
Try this
index=radware host=x.x.x.x action="drop" NOT src="y.y.y.y" NOT src="0.0.0.0" |fields src | stats count as _geo_count by src | geoip src | search _geo=* | geostats latfield=src_latitude longfield=src_longitude count
Thanks that put the bubbles on the map.
This is an image of what the original maps looked like (didn't have enough points to post it on the original question)
I don't find any formating options on the visulation tab that seem to apply. How do I make my map look similar to the orginal?
Thanks again
Where did you see this?
Going through older reports (stored outside of Splunk as pdfs) the documentation available indicates that the person I took over from used the above search and created these maps directly within Splunk. However, I can't find any info on how they are formated.
There must be an app installed in your instance which was used in a dashboard.