FAQ: How do I get GeoIP data for RDP user logins and place them on a World Map with magnitude?

worldMap() is a helper function that produces data compatible with the World Map widget. To find and prepare data for optimal results, you can use the following example to guide you:

#event_simpleName=UserLogon LogonType=10 RemoteAddressIP4=* 
| !cidr(RemoteAddressIP4, subnet=["", "", "", "", "", "", ""])
| ipLocation(aip)
| worldMap(ip=aip, magnitude=count(aid))