Additional zoom levels for maps in Splunk

Splunk’s default Cluster Map’s maximum zoom level is 7, which will let you see major cities in a country.

Splunk default map with zoom level 7

You can change it in the visualisation settings in the Tiles section

Splunk maps zoom level setting

But only increasing the Max Zoom level will not help much. The map visualisation will just show you a blank white canvas.

This is because Splunk installation doesn’t have the tiles (the images of the map) for a zoom level above 7.

Online Maps

This is an easy “fix” if your Splunk deployment is open to the internet (directly or over proxy).

Just point the URL to the Open Street Map (OSM) server: https://tile.openstreetmap.org/{z}/{x}/{y}.png.

Splunk maps tiles server setting

And you are a happy maps explorer, with a zoom level set to 18 (the maximum OSM allows) you can zoom in quite nicely

Open Street Maps zoom level 18

Offline Maps

But if your Splunk deployment can’t “reach” out to the OSM website (or other maps server) you are in a bit of a pickle. But fear not, there is a way forward. You will need to download these tiles (as png files) and add them to one of your splunk apps.

Now you could go download them one by one from the Open Street Maps manually or using some script, but it will take you some time (and probably you will be rate-limited by the OSM site)

The way forward:

Download an offline export of the OSM map you are after in the .osm.pbf format (Australia one can be found here Geofabrik Download Server )

Follow the guide here Using OpenStreetMap Offline with a few notes:

  • I was not specifying the docker image version (so use overv/openstreetmap-tile-server instead of overv/openstreetmap-tile-server:2.2.0)
  • x/y coordinates I’ve used for Australia are -x 111.35 -X 158.46 -y -46.85 -Y -10.87

to:

  • deploy a docker container with the map server
  • import the previously downloaded offline map
  • run rendering of tile (I wouldn’t go above 12-13 unless absolutely necessary as it takes time and space)
  • download the rendered tiles from the map server (docker) to your host (same comment as above)
Open Street Map image tiles folder size for Australia

Copy the tiles to a splunk app under <SPUNK>\etc\apps\MY_APP\appserver\static\tiles\

Update the map visualisation settings to point to the above location

Splunk maps setting the tiles’ server URL to a Splunk app

Start enjoying the offline maps with the zoom level you were crazy enough to render and add to Splunk:slight_smile:

The Easy way forward (if you are after a map of Australia):

For reading around till the end here is a shortcut:

The Easy way forward (if you are after other maps):

I can generate them for you for a small fee $$$ :-).

Need map tiles generated for you?

More posts about Splunk

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.