All Apps and Add-ons

Google Map not working in custom dashboard

hartfoml
Motivator

I feel stupid. I can't seem to get this working. I took the entire Google view xml and copied it to a new view in my custom app and it works perfectly.

I copy only the pieces I need into the costume dashboard with a "maysearchname" rather that the searchbar
I get the map but no search results.
I know the search produces results as it works OK in the Google app from the searchbar
I wish I could have someone stand over my shoulder to see the one little syntax thing I must be doing wrong
I have read several answers on this but just cant seem to get it.
I am not using the

0 Karma
1 Solution

Lamar
Splunk Employee
Splunk Employee

First things first, please include your actual code with your question. It will help tons, it could be as simple as you having a misspelled word or parameter (not likely, but it could be).

I'll be glad to help once you provide that.

View solution in original post

0 Karma

Lamar
Splunk Employee
Splunk Employee

Additionally, if you're using a Saved Search, include the search as well. Thanks.

0 Karma

Lamar
Splunk Employee
Splunk Employee

Sorry, I don't see the HiddenSearch or HiddenSavedSearch that's driving the GoogleMaps module.

Please include all of your code. Thank you.

0 Karma

ndcl
Path Finder

Hi,

did you add the GoogleMap module to your view? Check for this xml:

<param name="height">600px</param>

<param name="mapStyles">splunk</param>

<param name="overlay">clusters</param>

<param name="overlay.style">m</param>

<param name="overlay.opacity">0.75</param>

<param name="center">38,-74</param>

0 Karma

Lamar
Splunk Employee
Splunk Employee

First things first, please include your actual code with your question. It will help tons, it could be as simple as you having a misspelled word or parameter (not likely, but it could be).

I'll be glad to help once you provide that.

0 Karma

hartfoml
Motivator

This seemes to be case sensative but the "saved" fixed the problem.

Thanks Lamar for the help

0 Karma

Lamar
Splunk Employee
Splunk Employee

In your CDATA example above, you can't put < or > inside of it. Again, you may just want to try to change it to this:



MY Google Map

Because, you can't run a Saved Search with the HiddenSearch module. It doesn't matter if it's scheduled or not.

0 Karma

hartfoml
Motivator

When I use this search in the searchbar for Google map it works but when I call it from the xml it fails

0 Karma

hartfoml
Motivator

Here is my search
index="summary_My" splunk_server!=Remote* splunk_server!=*test* action!=DENY | rex "eventtype=\"(?<eventtype>\w+)\"" | search eventtype=list_ip [| inputlookup list.csv | rename Address as query | fields query ] | search NOT [| inputlookup whitelist.csv | search alow=yes | rename ip as destination_address | fields destination_address ] | geoip destination_address

0 Karma

hartfoml
Motivator

Lamar,

I used this line <param name="search"><![CDATA[<My Google Map>]]></param>

I received this error

SearchException: Error in 'search' command: Unable to parse the search: Comparator '<' is missing a term on the left hand side.

I think this issue is because of the regex extration in the search

0 Karma

hartfoml
Motivator

I will try the CDATA to see what I get.

I thought the "HiddenSavedSearch" and "savedSearch" are for scheduled search. this search starts when the dashboard opens not on a schedule. I'll try it though thanks and I'll let you know if it worked.

0 Karma

Lamar
Splunk Employee
Splunk Employee

Also, just noticed this about your module you're using "HiddenSearch", use HiddenSavedSearch and it should work.

Since you're using a Saved Search.

Like this:



MY Google Map

0 Karma

Lamar
Splunk Employee
Splunk Employee

You could use the CDATA tag around your search if you simply want to see it work.


<![CDATA[]]>

0 Karma

hartfoml
Motivator

yes this returned as expected from the searchbar useing the full Google xml from the google map view

I tried adding the search in the xml but the regex extraction | rex "eventtype=\"(?<eventtype>\w+)\"" where I have <eventtype> is seen by xml as a tag

0 Karma

Lamar
Splunk Employee
Splunk Employee

I assume that the field destination_address returns 'external' IP(s). Yes? When you run this search on your search bar, do you get all of the results of the geoip command? Like country_name, city_name, geo_info...etc?

0 Karma

hartfoml
Motivator

thanks Lamar for helping!!! 🙂

0 Karma

hartfoml
Motivator

"My Google Map" search

index="summary_My" splunk_server!=remote* splunk_server!=*test* action!=DENY | rex "eventtype=\"(?<eventtype>\w+)\"" | search eventtype=lookup_ip [| inputlookup lookup_ips.csv | rename Address as query | fields query ] | search NOT [| inputlookup whitelist.csv | search alow=yes | rename ip as query ] | geoip destination_address

0 Karma

hartfoml
Motivator

here is the xml

<module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="true">
<param name="search">MY Google Map</param>
<module name="GoogleMaps">
<param name="height">700px</param>
<param name="drilldown">true</param>
<param name="drilldown_field">clientip</param>
<param name="mapType">roadmap</param>
<param name="scrollwheel">off</param>
<param name="zoomLevel">3</param>
<param name="center">-11.867351, -167.695312</param>
</module>
</module>

0 Karma

hartfoml
Motivator

It would be great if someone would help with this?? I can pay in points for the answer 🙂

0 Karma

hartfoml
Motivator

I tested the search in the Google map app and it works. I was concerned that the Google map components would not work globally outside the Google app so I tested it like this. In manager>user interface>views>my custom app, I opened a new blank view. I called it my Google dashboard and copied the map view from the Google app line for line into my Google dashboard view and saved. the new dashboard in my custom app looked identical to the google map view and worked just as well with my search. When I tried to add my search to the code and take away searchbar module the search stopped working.

0 Karma

hartfoml
Motivator

Sorry it seems no one is making an attempt at helping so maybe I haven't explained well enough for anyone to understand.

It seems several people have been able to make Google map work in costume dash except me.

I am trying to use a Google map module in my costume dashboard. I converted the dashboard to complex xml so that I could add the code I needed

I used the code from this answer
http://splunk-base.splunk.com/answers/33824/integrating-google-map-into-dashboards

The map shows up but non of the "search data

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...