FAQ: How do I get GeoIP data for RDP user logins and place them on a World Map with magnitude?

worldMap() is a helper function that produces data compatible with the World Map widget. To find and prepare data for optimal results, you can use the following example to guide you: 

#event_simpleName=UserLogon LogonType=10 RemoteAddressIP4=* 
| !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/32"])
| ipLocation(aip)
| worldMap(ip=aip, magnitude=count(aid))