All Apps and Add-ons

Why isn't custom map showing accurate events

bayman
Path Finder

I'm using this Custom Cluster Map and it keeps showing the large pink bubble in South Africa and every other country with 1 event no matter what I search for. How do I fix this? https://splunkbase.splunk.com/app/3122/

eventtype=cisco-security-events dest_ip!="255.255.255.255" dest_ip!="0.0.0.0" src_ip="*" | eval isLocalIP=`local-ip-list(src_ip)` | where isLocalIP!=1 AND isnotnull(threat_reason) AND threat_reason!="-" | stats count by src_ip | iplocation src_ip | geostats latfield=lat longfield=lon count by Country

This is what the result looks like in Splunk Map for the same search:
alt text

This is what the result looks like in Custom Cluster Map for the same search (always 1 event in every blue bubble):
alt text

0 Karma
1 Solution

ziegfried
Influencer

The custom cluster map does not support split-by (ie. the geostats ... by Country part). It will display only the first series.

Example to plot the overall count:

... | geostats latfield=lat longfield=lon count

View solution in original post

ziegfried
Influencer

The custom cluster map does not support split-by (ie. the geostats ... by Country part). It will display only the first series.

Example to plot the overall count:

... | geostats latfield=lat longfield=lon count
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...