Flat world map by coordinates

Overview

This chart displays data geolocated on a world map using coordinates (latitude and longitude).

What data do I need for this widget?

The option to create this map will be disabled unless your query contains at least three columns with numeric values. Furthermore, to show meaningful content on the map, two of those columns must correspond to longitude and latitude and your data must be grouped.

Creating a flat world map by coordinates

1. Go to Data Search and open the required table.

2. Perform the required operations to get the data you want to use in the chart.

   If your table does not contain fields representing a pair of latitude and longitude values in integer or float format, you can use the operations in the Geolocation group to create latitude and longitude fields based on existing data in your table.

   For example, you can add to your table the latitude and longitude values corresponding to a set of IP addresses using the Geolocated Latitude (mmlatitude) and Geolocated Longitude (mmlongitude) operations.

3. Click the gear icon on the toolbar and select Charts → Maps → Flat world map by coordinates.

4. Click and drag the column headers to the corresponding fields. This chart requires you to select three fields:

   Required Field	Data Type
   Latitude	float, integer, duration
   Longitude	float, integer, duration
   Size/Color	float, integer, duration

5. The flat world map by coordinates is displayed.
   
   

Working with flat world maps by coordinates

To change the visualization style use the options at the top left:

• Map: click it to activate the street map view.
  Upon activation of this option, the Terrain option is displayed with a checkbox for you to mark. When marked, the map is displayed together with the topographic features.
• Satellite: Click it to activate the satellite imagery.
  Upon activation of this option, the Labels option is displayed with a checkbox for you to mark. When marked, the map is displayed together with the geo-political naming.

To change the visualization area you can perform the following actions:

• Click the + button at the bottom right to zoom in.
• Click the - button at the bottom right to zoom out.
• Left-click and drag to pan the map to the desired area.
• Press CTRL while scrolling up or down with the mouse wheel to zoom in or out.
• Click the button at the top right to toggle fullscreen mode.

You can hit the following keys to perform different actions:

Query example

You can recreate the example shown in the picture above with the data from the following query and mapping the fields as follows:

from siem.logtrust.web.activity
select ip4(srcHost) as ipHost,
mmlatitude(ipHost) as latitude, 
mmlongitude(ipHost) as longitude
group every 5m by longitude, latitude
every 5m
select count() as count