Splunk Search

How to apply colors of a choropleth map on a field other than count?

hylam
Contributor

Choropleth map applies different colors depending on the range of the "count" field. How can I use another field? If I have 4 distinct string values in the colorField, how can I set the 4 colors in hex?

1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

In the format dropdown you can use the "Categorical" Color Mode in the "Color" tab.
That gives you a different color for each string value.

If you need to customize the color mapping, there's two ways to do that:

  • Explicitly define the mapping by setting mapping.fieldColors in Simple XML, e.g. {"1. low":0xFF0000,"2. medium":0xFFFF00,"3. high":0x00FF00}
  • Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

View solution in original post

mporath_splunk
Splunk Employee
Splunk Employee

In the format dropdown you can use the "Categorical" Color Mode in the "Color" tab.
That gives you a different color for each string value.

If you need to customize the color mapping, there's two ways to do that:

  • Explicitly define the mapping by setting mapping.fieldColors in Simple XML, e.g. {"1. low":0xFF0000,"2. medium":0xFFFF00,"3. high":0x00FF00}
  • Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

splunk68
Path Finder

I went for the solution:
Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

To make it work for my purpose, I had to use a case statement (https://answers.splunk.com/answers/666322/edit-legend-from-choropleth-map-chart.html) to first generate all the categories, then sort them from the lowest to the highest, so that it can match the color order in the mapping.seriesColors.
1: Less 100 would get 0x00FF00 (green)
2: 100 to 500 would get 0xFFFF00 (yellow)
3: Over 500" would get 0xFF0000 (red)

Here a simplified example (as I had to do that for 9 categories...)
| eval count=case(count<100, "1: Less 100", (count>=100 AND count<500), "2: 100 to 500", count>500, "3: Over 500")
| sort +count
| geom geo_countries featureIdField=country

But honestly it's a pain. The proper way should be to be able to use sequential color mode and then be able to customize the data ranges for the legend.

0 Karma

hylam
Contributor

How can I use another field? How can I use a "colorField" other than "count"? I need the count field IN THE TOOLTIP to show something other than the color or the number mapped to the color when I mouseover.

colorField=red count=1
colorField=green count=1
colorField=blue count=1

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

Unfortunately that's not possible right now with maps alone. However, you can always setup a contextual drilldown and show additional information in an adjacent panel.

0 Karma

hylam
Contributor

mark as answer

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...