Thank you for downloading thge WebGL Globe visualization. Simply install through the UI (or extract into $SPLUNK_HOME/etc/apps) and the visualization will be available as an option alongside the default Splunk or other custom visualizations:
If you need to generate events with IP addresses to test the visualization, please use the following search:
| makeresults count=20000 | eval bitA=random() | eval ip=if(bitA<1,bitA+2147483648,bitA) | eval aaa=floor(ip/16777216) | eval bbb=floor((ip-aaa16777216)/65536) | eval ccc=floor((ip-(aaa16777216+bbb65536))/256)| eval ddd=ip-(aaa16777216+bbb65536+ccc256) | eval ipv4=tostring(ddd)+"."+tostring(ccc)+"."+tostring(bbb)+"."+tostring(aaa) | iplocation ipb4 | geostats count by Country
(I found the method for the integer->dotted quad IPv4 segment of this search in this Splunk Answer
The visualization has two tabs of configurable properties. The first tab handles the globe rendering, background, zoom, and UI. You can enable or disable both the control panel in the upper left and the legend in the lower right. If you have selected "Starfield" as the background, the background color option will have no effect. There are eight zoom levels (0-7).
The second tab handles the globe's animation. Static disables rotation whereas Animated rotates the globe at a frequency defined in the rotation period option (number of seconds for the globe to make a complete rotation along its vertical axis). The rotation period option does nothing if "Static" is selected.
In the UI, the controls in the upper left pan and tilt the globe, and provide zoom control. You may also drag the globe with the mouse (even if animated!) to pan/tilt/zoom. The legend in the lower right is build dynamically based upon the <by-clause> of the | geostats command. For more information on geostats, view the Splunk Geostats Documentation
The following resources helped me build this app. Attribution for third-party libraries can be found in the second link:
Scott Haskell's Clustered Single Value Map Visualization
Splunk's Custom Visualization Tutorial
Please feel free to reach out to me with comments, suggestions, issues, or ideas! Thank you again!
Updated icon location to support app certification.
Added appIconAlt and appIconAlt_2x
Removed savedsearches.conf
Updated initial configuration state of app
Added README with link to online documentation
Initial Version
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.