Visualizing Geolocation Data with DataSet and Grafana Geomap

Introduction

Grafana is a great tool to visualize data outside of the regular DataSet UI capabilities. Grafana has hundreds of plugins and allows for community development, so the possibilities are endless in regard to data visualization. 

You can leverage the superior performance and cost of DataSet with the superior visualization tools Grafana provides with the official DataSet Plugin for Grafana 

In this tutorial, we will visualize Okta logins on a geo map.  

Prerequisites

1. Grafana Cloud or Grafana OSS

If you don't have a Grafana cluster, you can spin a free one up here. 

If you would prefer to manage the infrastructure yourself you can install it here.  

2. Grafana Geomap Plugin installed 
If it is not already on your cluster, you can install it here (included w/ Grafana by default)

3. DataSet account
You can sign up for a trial here 

4. Dataset Plugin for Grafana installed. 
You can view how to do this here

5. Any logs with a latitude and longitude, country code, or geohash.

In this example, we are leveraging Okta logs and latitude / longitude.

Instructions

A. Format Data in Dataset

1. Identify where you may have some geolocational data. Or if you would prefer to enrich it, you can take a look at some scripts that will do that. 

2. Format your data. You will need Latitude AND Longitude OR geohash OR country code.

See Grafana Docs to see all formatting options 

Here is a sample of data coming from the Okta plugin 

You can use following query as an example: This query will be the input in section 7, below:

(serverHost contains 'okta' || k8s-cluster contains 'okta')
|group value = count() by latitude = client.geographicalContext.geolocation.lat+"", longitude = client.geographicalContext.geolocation.lon+"", key = client.geographicalContext.country 

B. Create Dashboard in Grafana

3. Create a new Dashboard

4. Add new panel

5. Change Visualization to "Geomap"

6. Select "Dataset" as "Data source" and "Powerquery" as "Query Type"  

7. Enter the Powerquery in the "Expression"

Example:

(serverHost contains 'okta' || k8s-cluster contains 'okta')
|group value = count() by latitude = client.geographicalContext.geolocation.lat+"", longitude = client.geographicalContext.geolocation.lon+"", key = client.geographicalContext.country 

8. Visualize your data