Splunk Search

use amMap without a lookup?

nate015
Explorer

amMap works fine using a lookup, but what if the data already has the client_city, client_region, client_country, client_lon, and client_lat in the events as fields?

I would like to map these events without generating a lookup table.

Tags (2)
0 Karma

bwooden
Splunk Employee
Splunk Employee

That will work as well. Whether you use maxmind, a custom CSV, or the search language ... the goal is the same: Make sure mapit has what it needs to plot your data on an amMap. Here is an example of plotting two points exclusively using the search language, sans lookup(s):

| stats count | eval count=1000| eval ip="127.0.0.1" | eval client_city="Santa Claus" | eval client_region="IN" | eval client_country="USA" | eval client_lon="-86.913958" | eval client_lat="38.120445" | eval movie_color="#FF0000" 
| append [| stats count | eval count=100| eval ip="10.0.0.1" | eval client_city="RMS" | eval client_region="Titanic" | eval client_country="Atlantic" | eval client_lon=-41 | eval client_lat=49 | eval movie_color="#8b8b8b"] 
| eval iterator="ip" | eval iterator_label="match or IP" | eval count_label="count" | eval output_file="home_threat_data.xml" | eval app="amMap" | mapit
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...