I feel stupid. I can't seem to get this working. I took the entire Google view xml and copied it to a new view in my custom app and it works perfectly.
I copy only the pieces I need into the costume dashboard with a
First things first, please include your actual code with your question. It will help tons, it could be as simple as you having a misspelled word or parameter (not likely, but it could be).
I'll be glad to help once you provide that.
Additionally, if you're using a Saved Search, include the search as well. Thanks.
Sorry, I don't see the HiddenSearch or HiddenSavedSearch that's driving the GoogleMaps module.
Please include all of your code. Thank you.
Hi,
did you add the GoogleMap module to your view? Check for this xml:
<param name="height">600px</param>
<param name="mapStyles">splunk</param>
<param name="overlay">clusters</param>
<param name="overlay.style">m</param>
<param name="overlay.opacity">0.75</param>
<param name="center">38,-74</param>
First things first, please include your actual code with your question. It will help tons, it could be as simple as you having a misspelled word or parameter (not likely, but it could be).
I'll be glad to help once you provide that.
This seemes to be case sensative but the "saved" fixed the problem.
Thanks Lamar for the help
In your CDATA example above, you can't put < or > inside of it. Again, you may just want to try to change it to this:
Because, you can't run a Saved Search with the HiddenSearch module. It doesn't matter if it's scheduled or not.
When I use this search in the searchbar for Google map it works but when I call it from the xml it fails
Here is my search
index="summary_My" splunk_server!=Remote* splunk_server!=*test* action!=DENY | rex "eventtype=\"(?<eventtype>\w+)\"" | search eventtype=list_ip [| inputlookup list.csv | rename Address as query | fields query ] | search NOT [| inputlookup whitelist.csv | search alow=yes | rename ip as destination_address | fields destination_address ] | geoip destination_address
Lamar,
I used this line <param name="search"><![CDATA[<My Google Map>]]></param>
I received this error
SearchException: Error in 'search' command: Unable to parse the search: Comparator '<' is missing a term on the left hand side.
I think this issue is because of the regex extration in the search
I will try the CDATA to see what I get.
I thought the "HiddenSavedSearch" and "savedSearch" are for scheduled search. this search starts when the dashboard opens not on a schedule. I'll try it though thanks and I'll let you know if it worked.
Also, just noticed this about your module you're using "HiddenSearch", use HiddenSavedSearch and it should work.
Since you're using a Saved Search.
Like this:
You could use the CDATA tag around your search if you simply want to see it work.
yes this returned as expected from the searchbar useing the full Google xml from the google map view
I tried adding the search in the xml but the regex extraction | rex "eventtype=\"(?<eventtype>\w+)\""
where I have <eventtype>
is seen by xml as a tag
I assume that the field destination_address returns 'external' IP(s). Yes? When you run this search on your search bar, do you get all of the results of the geoip command? Like country_name, city_name, geo_info...etc?
thanks Lamar for helping!!! 🙂
"My Google Map" search
index="summary_My" splunk_server!=remote* splunk_server!=*test* action!=DENY | rex "eventtype=\"(?<eventtype>\w+)\"" | search eventtype=lookup_ip [| inputlookup lookup_ips.csv | rename Address as query | fields query ] | search NOT [| inputlookup whitelist.csv | search alow=yes | rename ip as query ] | geoip destination_address
here is the xml
<module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="true">
<param name="search">MY Google Map</param>
<module name="GoogleMaps">
<param name="height">700px</param>
<param name="drilldown">true</param>
<param name="drilldown_field">clientip</param>
<param name="mapType">roadmap</param>
<param name="scrollwheel">off</param>
<param name="zoomLevel">3</param>
<param name="center">-11.867351, -167.695312</param>
</module>
</module>
It would be great if someone would help with this?? I can pay in points for the answer 🙂
I tested the search in the Google map app and it works. I was concerned that the Google map components would not work globally outside the Google app so I tested it like this. In manager>user interface>views>my custom app, I opened a new blank view. I called it my Google dashboard and copied the map view from the Google app line for line into my Google dashboard view and saved. the new dashboard in my custom app looked identical to the google map view and worked just as well with my search. When I tried to add my search to the code and take away searchbar module the search stopped working.
Sorry it seems no one is making an attempt at helping so maybe I haven't explained well enough for anyone to understand.
It seems several people have been able to make Google map work in costume dash except me.
I am trying to use a Google map module in my costume dashboard. I converted the dashboard to complex xml so that I could add the code I needed
I used the code from this answer
http://splunk-base.splunk.com/answers/33824/integrating-google-map-into-dashboards
The map shows up but non of the "search data