Refine your search:

amMap works fine using a lookup, but what if the data already has the client_city, client_region, client_country, client_lon, and client_lat in the events as fields?

I would like to map these events without generating a lookup table.

asked 09 Aug '11, 13:49

nate015's gravatar image

nate015
636
accept rate: 0%

edited 09 Aug '11, 13:55


One Answer:

That will work as well. Whether you use maxmind, a custom CSV, or the search language ... the goal is the same: Make sure mapit has what it needs to plot your data on an amMap. Here is an example of plotting two points exclusively using the search language, sans lookup(s):

| stats count | eval count=1000| eval ip="127.0.0.1" | eval client_city="Santa Claus" | eval client_region="IN" | eval client_country="USA" | eval client_lon="-86.913958" | eval client_lat="38.120445" | eval movie_color="#FF0000" 
| append [| stats count | eval count=100| eval ip="10.0.0.1" | eval client_city="RMS" | eval client_region="Titanic" | eval client_country="Atlantic" | eval client_lon=-41 | eval client_lat=49 | eval movie_color="#8b8b8b"] 
| eval iterator="ip" | eval iterator_label="match or IP" | eval count_label="count" | eval output_file="home_threat_data.xml" | eval app="amMap" | mapit
link

answered 23 Feb, 07:12

bwooden's gravatar image

bwooden ♦
2.3k19
accept rate: 38%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×66
×19

Asked: 09 Aug '11, 13:49

Seen: 597 times

Last updated: 23 Feb, 07:12

Copyright © 2005-2012 Splunk, Inc. All rights reserved.