topic Re: How to change bin value ranges using choropleth map? in All Apps and Add-ons

How to change bin value ranges using choropleth map?

jmchilde — Tue, 13 Oct 2015 19:50:43 GMT

Hello,

I currently have 9 bins enabled. The lowest default bin range on my map is 0-600k, which is assigned the white color. All but one country fall into the 0-600k range, so only one country is highlighted while the others are all white. This doesn't give me very good contrast on all of the other countries.

How can I change the the bin value ranges? For example, lowering the smallest bin range (white) to 0-50 means any country with a value greater than 50 would be assigned a color (not white).

Re: How to change bin value ranges using choropleth map?

mporath_splunk — Tue, 13 Oct 2015 20:37:28 GMT

Unfortunately that's not possible at this moment with Splunk 6.3..

Let me offer you an alternative. Often when something like this happens it's because the one country's population (or user base or similar metric) is far larger than all other countries, outweighing all other countries when simply counting a metric. Take for example the use case of web analytics. The US with its ~320M will likely generate many more visitors than, say, Switzerland with its ~8M.

One way around that is to normalize the metric. Three examples:

You could do something like visits per capita (dividing visits by the population number for each country).
You could compare a number for this week to the same metric last week.
You could compare each number to a predefined goal or target

That being said, it's absolutely possible that none of these will work for your use case, and you are indeed interested in absolute numbers.

Re: How to change bin value ranges using choropleth map?

jmchilde — Wed, 14 Oct 2015 14:21:45 GMT

Thanks for that. Unfortunately, I am comparing absolute values but I really appreciate the alternatives. I'd definitely like to see this option added as a feature similar to how you add a neutral point in the divergent map. The choropleth map is not useful if any absolute values are significantly deviated.

Re: How to change bin value ranges using choropleth map?

jdswanson — Thu, 22 Oct 2015 16:06:25 GMT

I concur. Would like to see custom bins for absolute values.

Re: How to change bin value ranges using choropleth map?

gchung_splunk — Sun, 25 Oct 2015 18:16:47 GMT

How about group it by yourself as a workaround? Try something like this:

| eval count= case(count<=10,"0-10", count>10 AND count<=100, "11-100", count<=10000, "101-10000", count>10000, "10000+")

And group it by Categorical?

Re: How to change bin value ranges using choropleth map?

mporath_splunk — Mon, 26 Oct 2015 22:59:08 GMT

@gchung's answer would work! If categorical coloring doesn't work as expected, you could define your own mapping.seriesColors option, e.g. with values {"0-10": "#FAEDA5", "11-100": #F7B44C, "101-10000", : "#FF4B2A""10000+": "#C10028"}, which is a gradient from yellow to red

Re: How to change bin value ranges using choropleth map?

jmchilde — Tue, 27 Oct 2015 14:14:54 GMT

Thanks all. I will give this a try!

Re: How to change bin value ranges using choropleth map?

brettwilliams — Wed, 10 Feb 2016 06:11:31 GMT

This definitely is interesting... and it seems like it would work if the cases match the expected results. What about ranking with streamstats and then putting these in bins?

index=index "Login succeeded" | iplocation source_ip | stats count by Country | sort -count | streamstats count as rank | bucket rank span=5 as bucket

And somehow combining it with a working geom search, but using the categories which match the bucket field instead of the count:

index=index "Login succeeded" | iplocation source_ip | lookup geo_us_states longitude as lon, latitude as lat | stats count by featureId | geom geo_us_states

Re: How to change bin value ranges using choropleth map?

Simon — Tue, 07 Jun 2016 08:03:56 GMT

I'm using kmeans to create dynamic "categories" based on a numeric field:

index=index "Login succeeded" | iplocation source_ip | lookup geo_us_states longitude as lon, latitude as lat | stats count by featureId | geom geo_us_states  | kmeans k=5 count | eventstats min(count) AS min, max(count) AS max by CLUSTERNUM | sort min | eval count=min."-".max | fields - CLUSTERNUM centroid_count max min

where
- k=5 defines the number of clusters/categories (5 in this case)
- evenstats / eval is used to create a dynamic label for the category in the field "count" showing min and max of count

HTH.

Best,
Simon

Re: How to change bin value ranges using choropleth map?

GRMcCauley — Sun, 14 Aug 2016 19:13:11 GMT

@Simon - This is VERY helpful. Thank You!

Re: How to change bin value ranges using choropleth map?

carlkennedy — Fri, 24 Feb 2017 13:01:00 GMT

Did this option get added in 6.4 or 6.5? If not, is it on the roadmap for a future release? I am using states and four bins. The largest value for a particular state is 94,000. My buckets have these ranges:
0 - 60,000
60,000 - 120,000
120,000 - 180,000
180,000 - 240,000

Re: How to change bin value ranges using choropleth map?

Reimer1291 — Thu, 20 Jul 2017 12:25:08 GMT

If you want to avoid bins being colored white, you can use the "Divergent" color option with an even number of bins.

Re: How to change bin value ranges using choropleth map?

TonyLeeVT — Tue, 01 Oct 2019 13:28:52 GMT

Thanks for all the input on this issue.

@jmchilde - Did it work?

@mporath_splunk - Could you please provide a working example?