I have this query and I want create chroplate map based on count, I am apperciate if some one give some insight.
my objective is to display failed user name attempt per ip, preferably failed more than 5 times on chroplate map sorted by the ip with highest failed user name.
index=user host=web* "failed user name" | stats count by userip
Hi There,
I'm assuming you are referring to Chloropleth maps, on this you should be able to find most the information on these here:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/ChoroplethGenerate
For yours specifically your going to want to use the iplocation
command after your query
https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Iplocation