How to convert at geo map to a choropleth map?

[bworrellZP]

I currently use a GEO map, that meets most of my requested outcome, but was asked if we can swap to a choropleth map for better visualization and data.

Using this search, I get the below:

index="Foo" NOT Error="0" | iplocation allfields=true IPAddress |  geostats globallimit=0 count by Error

Using this search, I get the below.

index="Foo" NOT Error="0"
| iplocation IPAddress
| stats count(Error) by Region
| geom geo_us_states featureIdField=Region

Somewhere I am missing how to change it to get it to show the number of each error type, when hovering over the state.

Any ideas?

[jkat54]

Also, you may be interested in another map viz. called clustered single value map visualization. You get it by clicking on "find more visualizations" in the visualization name drop down... or via the app manager / splunkbase.

With it I was able to work some magic and get multiple markers for each EventCode in the event logs i have in my main index. In this case i had 4 events with EventCode 1001 which "happened" in new york.

  ... | iplocation src_ip | rename lon AS longitude lat as latitude | stats count(EventCode) as Count by EventCode latitude, longitude | eval description=mvzip(EventCode,Count) |  table latitude longitude description

[bworrellZP]

Thank you, that did provide interesting visuals, but appears to not be what they wanted created.

[jkat54]

what happens if you try list(Error) in your stats command?

[bworrellZP]

If I replace the Count with List, I get each incident of 2020 in a line, for example.

[jkat54]

yeah i tested and it didnt work for me either.