Splunk Operational Intelligence Cookbook - Third Edition

Adding a map panel using Simple XML

A map panel can be added directly to a dashboard by adding the following Simple XML when editing the dashboard source:

  <row> 
    <panel> 
      <map> 
        <title>Count by location</title> 
        <search> 
          <query>index=main sourcetype=access_combined clientip="$ip$" | iplocation clientip  | fillnull value="Unknown" City, Country, Region| replace "" with "Unknown" in City, Country, Region | search City="$city$" Region="$region$" Country="$country$" | geostats count</query> 
          <earliest>-24h@m</earliest> 
          <latest>now</latest> 
        </search> 
        <option name="mapping.data.maxClusters">100</option> 
        <option name="mapping.drilldown">all</option> 
        <option name="mapping.map.center">(0,0)</option> 
      </map> 
    </panel> 
  </row>