Skip to main content
Sumo Logic

Map Charts

Map charts show the location and number of hits from data on a map.

To map your data you can:

  • use the Geo Lookup operator to provide these values from extracted IPv4 and IPv6 addresses.
  • manually provide valid aggregated latitude and longitude values. Ensure the field names are 'latitude' and 'longitude' so that map chart can recognize them. Format the values with positive or negative values based on being north/south or east/west, instead of using the terms N/S, E/W, such as, 30.42 and -87.21.

For example, you could use the following geo lookup query to create a map chart:

_sourceCategory=Error
| parse regex "(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| lookup latitude, longitude, country_code, country_name, region, city, postal_code from geo://location on ip = client_ip
| count by latitude, longitude, country_code, country_name, region, city, postal_code
| sort _count

which would produce results such as:

geo lookup results fields.png

Rules

  • Latitude and longitude values need to be provided with the fields 'latitude' and 'longitude' respectively.
  • Latitude and longitude values need to be positive or negative based on being north/south or east/west, instead of using the terms N/S, E/W, such as, 30.42 and -87.21.
  • A _count aggregator is required. 
  • Other aggregators like sum or avg do not provide accurate results. 

Limitations

  • Map charts have a display limit of 10,000 results.
  • Colors of map markers cannot be changed.

Create a map chart

To add a panel with a map chart:

  1. Create or open a Dashboard (New) and click on Add Panel > Map.
    map panel option.png
  2. Provide a Geo Lookup query and press Enter for it to run.

    Add log query.png

  3. A map chart is available in two types, Cluster or Heatmap.
    new cluster map.png
    new heat map.png

  4. Modify the chart as desired.
  5. Click the Add to Dashboard button on the top right of the window to add the panel to your dashboard.
    Add to Dashboard button.png