Splunk Search

My values are not showing on map

bryso25
New Member

Hello, Im very new with Splunk. Can you please tell me what is missing on my search string

eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields - percent |geom geo_countries featureIdField=count

I need to show the values on my map however it is showing blank and no colors. Please help.

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To plot results on a map, the events need to contain latitude and longitude, which your query appears to be missing. Add those fields to your query, if you have them. If you don't have those fields, you can use the iplocation command to derive latitude and longitude from an IP address. Then use geostats to plot the results.

eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields - percent | iplocation foo | geostats count by Site
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

493669
Super Champion
eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields count Site |geom geo_countries featureIdField=Site

Use featureIdField as Site

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To plot results on a map, the events need to contain latitude and longitude, which your query appears to be missing. Add those fields to your query, if you have them. If you don't have those fields, you can use the iplocation command to derive latitude and longitude from an IP address. Then use geostats to plot the results.

eventtype=security * user_Type=INT user_Organization="BODI" | top limit=20 user_Location | rename user_Location as Site | fields - percent | iplocation foo | geostats count by Site
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...