Splunk Search

How to troubleshoot why my Choropleth map is not showing a certain Spanish Region using Splunk 6.4?

slr
Communicator

Hello.

I'm trying to plot values by regions in a choropleth map with a search like this:

|inputlookup some.csv | iplocation lang=es IP | search Region!="" Country="España" | stats count by Region | geom spain-regions featureIdField=Region

All regions are put in place...except Murcia. The geom field is empty for Murcia. If iplocation was wrong with the "typing" of Murcia (Who knows...) I created a CSV with two fields: Region and Values, and in Region, I wrote all the Spanish Regions... and again, Murcia didn't show up (yes, the rest of them show up in the map).

Could I list all the Spanish regions that geom accepts? Is this some kind of bug?

By the way, the deployment is an Ubuntu 14.04 64bits with Splunk Enterprise 6.4

Regards.

PD: If you think Murcia is misspelled, see this: https://en.wikipedia.org/wiki/Murcia

0 Karma
1 Solution

slr
Communicator

Ok, I found the problem.

When you use iplocation, you can obtain Continent, Country, Region and City... but in Spain exist an extra division: Province. Better if I type an example:

Europe (Continent) has 28 Countries. Spain (Country) has 17 Regions and 50 Provinces. Galicia is a Region with 4 Provinces: Pontevedra, Orense, Lugo, La Coruña. Any Province has a lot of cities and towns; for example, Pontevedra has Vigo, Pontevedra (capital), Sanxenxo, Moaña, Tui, etc...

Iplocation don't have a Province element, and at least for Spain, geom mix the Regions with the Provinces. In my case, in Spain I want the Province of Murcia (Murcia) but I get the Region (Región de Murcia), but if I want the real Regions (the 17) I can't get them with iplocation.

Maybe this is happening with other countries... but I hope this can be fix with a future release.

Regards.

Region list: https://en.wikipedia.org/wiki/Autonomous_communities_of_Spain
Province list: https://en.wikipedia.org/wiki/Provinces_of_Spain

View solution in original post

slr
Communicator

Ok, I found the problem.

When you use iplocation, you can obtain Continent, Country, Region and City... but in Spain exist an extra division: Province. Better if I type an example:

Europe (Continent) has 28 Countries. Spain (Country) has 17 Regions and 50 Provinces. Galicia is a Region with 4 Provinces: Pontevedra, Orense, Lugo, La Coruña. Any Province has a lot of cities and towns; for example, Pontevedra has Vigo, Pontevedra (capital), Sanxenxo, Moaña, Tui, etc...

Iplocation don't have a Province element, and at least for Spain, geom mix the Regions with the Provinces. In my case, in Spain I want the Province of Murcia (Murcia) but I get the Region (Región de Murcia), but if I want the real Regions (the 17) I can't get them with iplocation.

Maybe this is happening with other countries... but I hope this can be fix with a future release.

Regards.

Region list: https://en.wikipedia.org/wiki/Autonomous_communities_of_Spain
Province list: https://en.wikipedia.org/wiki/Provinces_of_Spain

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...