You would have to do it with a lookup table that enriches the ZIP codes with their geographical data , see this previous Splunk Answers posting for pointers.
we got correct answers from here http://answers.splunk.com/answers/153968/how-to-edit-my-search-query-to-display-a-map-graph.html
Thanks, I am trying to build the MAP with the below query, i could see some results in the statistics view but its nothing showing in Map (zip, Lat and Long). Can you please review this query and correct me if anything wrong.
index="abcindex" | stats sum(Primary_Address_ZIP) as _geo_count by Primary_Address_ZIP | lookup geolookup Zipcode as Primary_Address_ZIP OUTPUT Lat, Long | where Lat not null AND Long not null | eval _geo=Lat+","+Long