All Apps and Add-ons

How to add colors based on ranges in the HERE Maps app?

SanthoshSreshta
Contributor

I want to add range wise colors to my geostats map. I have tried, but some where I read that it can be possible by HERE maps also, so i have installed it a free version.
Can anyone help me in getting the colors based on ranges.
the query i have used is:

source="Churn_Map.csv" sourcetype="Churn_map" | eval Churn = if(Churn="True.","1","0") 
| eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state  
| eval prop= true_churn*100 / total_churn  | geostats values(prop) as p by StateName   globallimit=0

Thanks,
Santhosh.
statistc_output

output what i got. without range colors 😞

output

Tags (3)
0 Karma

pietervi
Path Finder

Hi Santhosh,

The best way for visualizing this could be the US state shape map.
You'll find an example dashboard in the HERE maps app under the following url: https://splunkhostname/en-US/app/heremaps/shapemapcustom_us
You'll find it under the menu item "Shapemap -> Other countries -> Custom Shape map US"

Your command is actually quite good already. The only issue is that your data uses state names. The shape map expects you to use state codes and put these in the "key" field and you also need a "value" field.

source="Churn_Map.csv" sourcetype="Churn_map" | eval Churn = if(Churn="True.","1","0") 
 | eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state  
 | eval prop= true_churn*100 / total_churn | stats values(prop) as value by state | eval key=state

The result of the command should look like this:

| key    | value     |
| AL     | 10        |
|        | 5,769231  |
| AK     | 5,769231  |
| AZ     | 6,250000  |
| AR     | 20        |
| CA     | 26,470588 |

When you get this output try the search out in the example dashboard and you should see the color ranges applied for each state.

Hope that helps,
Pieter

0 Karma

vganjare
Builder

What is the sample output generated from above query?

Thanks!!

0 Karma

SanthoshSreshta
Contributor

@vganjare I have added to the Question. please check it out.

0 Karma

vganjare
Builder

Can you please share the output (data in text format) generated from following query:
source="Churn_Map.csv" sourcetype="Churn_map" | eval Churn = if(Churn="True.","1","0")
| eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state

| eval prop= true_churn*100 / total_churn

Thanks!!

0 Karma

SanthoshSreshta
Contributor

Are you asking me the statistic output after the query. if it is, then i have posted in the question too. please check it out .

0 Karma

vganjare
Builder

Yes. Can you please provide the text format output? Do not include the geostat command.

Thanks!!

0 Karma

SanthoshSreshta
Contributor

I have uploaded the output, with for the query. please check in the post again @vganjare
source="Churn_Map.csv" sourcetype="Churn_map" | eval Churn = if(Churn="True.","1","0")
| eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state
| eval prop= true_churn*100 / total_churn
| stats values(prop) by StateName

0 Karma

vganjare
Builder

Its in the .jpg format. Can you post the output inline in the comments section? Provide the output before the geostat command. The image you have uploaded is showing the output after stats command.

Thanks!!

0 Karma

SanthoshSreshta
Contributor

I am unable to understand what you are asking @vganjare

0 Karma

vganjare
Builder

Provide the output in following format:

State,Count
Alabama,15
California,20
Florida,25

Hawaii,40

This is the output after stats command. If you execute the query:

source="Churn_Map.csv" sourcetype="Churn_map" | eval Churn = if(Churn="True.","1","0")
| eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state

| eval prop= true_churn*100 / total_churn

You will get some result. Export this result as CSV. Open the CSV in text pad. Copy all the content and paste it in the comments section.

Your csv content here

Thanks!!

0 Karma

vganjare
Builder

Yes. Share 20-30 rows so that I can understand the format.

0 Karma

SanthoshSreshta
Contributor

Churn,StateName,"raw","time","account length","area code",eventtype,host,index,"international plan",lat,linecount,lon,"number customer service calls","number vmail messages","phone number",prop,punct,source,sourcetype,"splunk_server","splunk_server_group",state,timestamp,"total day calls","total day charge","total day minutes","total eve calls","total eve charge","total eve minutes","total intl calls","total intl charge","total intl minutes","total night calls","total night charge","total night minutes","total_churn","true_churn","voice mail plan"
0,,"TN ,,,,74,415,400-4344 ,no ,yes ,25,234.4,113,39.85,265.9,82,22.6,241.4,77,10.86,13.7,4,3.7,0,False.","2015-05-15T16:44:39.000+0530",74,415,,"127.0.0.1",main,no,,1,,0,25,"400-4344","9.433962",",,,,,,-,,,,.,,.,.,,.,.,,.,.,,.,,.","Churn_Map.csv","Churn_map","LTCPU069-PC",,TN,none,113,"39.85","234.4",82,"22.6","265.9",4,"3.7","13.7",77,"10.86","241.4",53,5,yes

0,Connecticut,"CT ,41.5834,-72.7622,Connecticut,184,510,364-6381 ,yes ,no ,0,213.8,105,36.35,159.6,84,13.57,139.2,137,6.26,5,10,1.35,2,False.","2015-05-15T16:44:39.000+0530",184,510,,"127.0.0.1",main,yes,"41.5834",1,"-72.7622",2,0,"364-6381","16.216216",",.,-.,,,,-,,,,.,,.,.,,.,.,,.,,,.,,.","Churn_Map.csv","Churn_map","LTCPU069-PC",,CT,none,105,"36.35","213.8",84,"13.57","159.6",10,"1.35",5,137,"6.26","139.2",74,12,no

0,"Rhode Island","RI ,41.6772,-71.5101,Rhode Island,28,510,328-8230 ,no ,no ,0,180.8,109,30.74,288.8,58,24.55,191.9,91,8.64,14.1,6,3.81,2,False."

0 Karma

SanthoshSreshta
Contributor

@vganjare
source="Churn_Map.csv" sourcetype="Churn_map" | eval Churn = if(Churn="True.","1","0")
| eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state
| eval prop= true_churn*100 / total_churn
no data is coming while executing the above query. even though, i exported to csv. then there is lot of data. can i post such data here. please make me sure that, you are expecting to the output of the exact above mentioned query . there is no stats or table command to that query. is it what you are expecting .?

0 Karma

SanthoshSreshta
Contributor

Here it is @vganjare

StateName,"values(prop)"
Alabama,"10 5.769231"
Alaska,"5.769231"
Arizona,"6.250000"
Arkansas,20
California,"26.470588"
Colorado,"13.636364"
Connecticut,"16.216216"
Delaware,"14.754098"
"District of Columbia","9.259259"
Florida,"12.698413"
Georgia,"14.814815"
Hawaii,"5.660377"
Idaho,"12.328767"
Illinois,"8.620690"
Indiana,"12.676056"
Iowa,"6.818182"
Kansas,"18.571429"
Kentucky,"13.559322"
Louisiana,"7.843137"
Maine,"20.967742"
Maryland,"24.285714"
Massachusetts,"16.923077"
Michigan,"21.917808"
Minnesota,"17.857143"
Mississippi,"21.538462"
Missouri,"11.111111"
Montana,"20.588235"
Nebraska,"8.196721"
Nevada,"21.212121"
"New Hampshire","16.071429"
"New Jersey","26.470588"
"New Mexico","9.677419"
"New York","18.072289"
"North Carolina","16.176471"
"North Dakota","9.677419"
Ohio,"12.820513"
Oklahoma,"14.754098"
Oregon,"14.102564"
Pennsylvania,"17.777778"
"Rhode Island","9.230769"
"South Carolina","23.333333"
"South Dakota","13.333333"
Tennessee,"9.433962"
Texas,25
Utah,"13.888889"
Vermont,"10.958904"
Virginia,"6.493506"
Washington,"21.212121"
"West Virginia","9.433962"
Wisconsin,"8.974359"
Wyoming,"11.688312"

0 Karma

vganjare
Builder

Can you please verify if this is the output of query:

source="Churn_Map.csv" sourcetype="Churn_map" | eval Churn = if(Churn="True.","1","0")
| eventstats sum(Churn) as true_churn , count(Churn) as total_churn by state

| eval prop= true_churn*100 / total_churn

Ideally, the output should have columns like Churn, tru_churn total_churn prop and few more

Thanks!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...