I got it to work. I'd love to be able to get more specific with the locations instead of the center of a country, but for today this will do.
Here is code to the query made in grafana
SELECT "action" FROM "tail_ip_block_log" WHERE ("host" =~ /^$Host$/ AND "action" = 'block' AND "direction" = 'in') AND $timeFilter GROUP BY "geoip_code"::tag
Here is grafan code to panel JSON```
{
"datasource": {
"uid": "$dataSource",
"type": "influxdb"
},
"fieldConfig": {
"defaults": {
"custom": {
"hideFrom": {
"tooltip": false,
"viz": false,
"legend": false
}
},
"mappings": [],
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
},
{
"color": "red",
"value": 80
}
]
},
"color": {
"mode": "thresholds"
}
},
"overrides": []
},
"gridPos": {
"h": 9,
"w": 6,
"x": 9,
"y": 16
},
"id": 563,
"maxDataPoints": 1,
"options": {
"view": {
"allLayers": true,
"id": "zero",
"lat": 0,
"lon": 0,
"zoom": 1
},
"controls": {
"showZoom": true,
"mouseWheelZoom": true,
"showAttribution": true,
"showScale": false,
"showMeasure": false,
"showDebug": true
},
"tooltip": {
"mode": "details"
},
"layers": [
{
"type": "markers",
"name": "Layer 1",
"config": {
"style": {
"size": {
"fixed": 5,
"min": 2,
"max": 10,
"field": "Time"
},
"color": {
"fixed": "red"
},
"opacity": 0.2,
"symbol": {
"mode": "fixed",
"fixed": "img/icons/marker/circle.svg"
},
"textConfig": {
"fontSize": 12,
"textAlign": "center",
"textBaseline": "middle",
"offsetX": 0,
"offsetY": 0
},
"rotation": {
"fixed": 0,
"mode": "mod",
"min": -360,
"max": 360
},
"text": {
"fixed": "",
"mode": "fixed",
"field": "geoip_code"
}
},
"showLegend": true
},
"location": {
"mode": "lookup",
"geohash": "geoip_code",
"lookup": "geoip_code"
},
"tooltip": true
}
],
"basemap": {
"type": "default",
"name": "Layer 0",
"config": {}
}
},
"pluginVersion": "10.1.1",
"targets": [
{
"datasource": {
"uid": "$dataSource"
},
"alias": "$tag_geoip_code",
"groupBy": [
{
"params": [
"geoip_code::tag"
],
"type": "tag"
}
],
"measurement": "tail_ip_block_log",
"orderByTime": "ASC",
"policy": "default",
"query": "SELECT count("action") FROM "tail_ip_block_log" WHERE ("host" =~ /^$Host$/ AND "action" = 'block' AND "direction" = 'in'), AND $timeFilter GROUP BY time(10m), "geoip_code"::tag",
"rawQuery": false,
"refId": "A",
"resultFormat": "table",
"select": [
[
{
"params": [
"action"
],
"type": "field"
}
]
],
"tags": [
{
"key": "host",
"operator": "=~",
"value": "/^$Host$/"
},
{
"condition": "AND",
"key": "action",
"operator": "=",
"value": "block"
},
{
"condition": "AND",
"key": "direction",
"operator": "=",
"value": "in"
}
]
}
],
"title": "IP - Src/Dst Blocked Geo",
"type": "geomap",
"description": ""
}
