Splunk Dev

country code to Choropleth ?

posinga
New Member

I'm trying to get country codes in to the Choropleth map, but i'm a bit stuck.
I'm using the following search

index="someindex*" what=tagged | lookup geo_countries longitude as Longitude, latitude as Latitude | top limit=20 country_code  | rename country_code to country  | geom geo_countries featureIdField="country"

The output is as follows
alt text

How can I get the colors / numbers on the map with this set of data ?

*Update *
With the following query i'm able to get the stats in the map. Though since you cannot change the bin scale only the US is colored, while the rest of the world maps stays white.

index="someindex*" what=tagged | stats count by country_code |  rename country_code AS iso2 |lookup geo_attr_countries iso2 OUTPUT country |  fields+ count, country, geom | geom geo_countries featureIdField="country"

alt text

regards,
Pascal

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Okay, you are trying to use 2-digit country_code but feeding them in as country, which is a different field...

Try this -

 index="someindex*" what=tagged 
| lookup geo_countries longitude as Longitude, latitude as Latitude OUTPUT country
| top limit=20 country 
| geom geo_countries featureIdField="country"

Reference-
https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html

0 Karma

posinga
New Member

Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...