Hi @inventsekar , Here is my SPL for Missle Map, | tstats `security_content_summariesonly` count from datamodel=Intrusion_Detection.IDS_Attacks where (NOT IDS_Attacks.src IN(192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 8.8.8.8, 0.0.0.0, 1.1.1.1, 0:0:0:0:0:0:0:1,"unknown",34.87.171.169 )) NOT IDS_Attacks.severity IN (low, informational) by IDS_Attacks.src | rename IDS_Attacks.* as * | eval animate="true" | iplocation dest prefix=end_ | iplocation src prefix=start_ | eval end_lat=if(isnull(end_lat),21.007647, end_lat) | eval end_lon=if(isnull(end_lon),105.807235, end_lon) | eval color = case(count <= 100, "#8fce00", count > 100 AND count <= 300, "#ed8821", 1=1, "#f44336") | eval end_City="Hanoi", end_Country="Vietnam", end_Region="Hanoi" | sort -count | dedup start_Country | table animate color count dest end_City end_Country end_Region end_lat end_lon src start_City start_Country start_Region start_lat start_lon
... View more