1-As a first step, prepare the query for the report on the Search page as shown in the example below. A Map report places events on the world map by the Source.Country column, so your query should return events in which Source.Country is populated.
Click the "+ Report" button to open the report form. Your search query and the selected index are carried over to the form automatically.
2-The report form has two steps: Report (Set Information) and Query (Set Query). Fill in the fields as shown below:
In the Report step:
Report Name: Enter the report name. This is a required field.
Report Note: Optional text shown under the report title in PDF and HTML exports.
Report Type: Must be selected as Map.
Time Column: This field is predefined as the Time.Generated column. The report uses the value of the selected date column as time.
Report Block: Select the report block the report will be listed under. You can also choose Add New Block and enter a Block Name to create a new block.
Category: Select a category for the report (General, Custom/My Report, Compliance or Vendor Specific). The default is General.
Roles: Select the roles that can access the report. This is not a required field.
Compliance: Select one or more compliance standards for the report. This is not a required field.
Index: This field is predefined as Events, which builds the report from indexed logs. You can also select Incidents or Responses. The column names change according to the selected index. The Offline option is not available for the Map report type.
Tags: Select tags for the report. This is not a required field.
Click Next to continue to the Query step:
Query: Enter your query in this field. If you start from the Search page with the "+ Report" button, this field is already filled with your search query. You can also tick Select Query From Report to copy the query of an existing report.
Row Count: Determine how many rows the report shows. The default is 50.
Filter Fields: Select which columns can be used to filter the report. You can also tick Select Filter From Fieldsets to fill this field from a fieldset.
Chart Colors: Select the color palette of the map.
3- After you fill in the required fields and click the Save button, you'll be able to view the report results as shown below.
Map reports cannot be downloaded from the report page and are not listed when you create a scheduled report.