topic country code to Choropleth ? in Splunk Dev

country code to Choropleth ?

posinga — Fri, 24 Mar 2017 10:11:16 GMT

I'm trying to get country codes in to the Choropleth map, but i'm a bit stuck.
I'm using the following search

index="someindex*" what=tagged | lookup geo_countries longitude as Longitude, latitude as Latitude | top limit=20 country_code  | rename country_code to country  | geom geo_countries featureIdField="country"

The output is as follows

How can I get the colors / numbers on the map with this set of data ?

*Update *
With the following query i'm able to get the stats in the map. Though since you cannot change the bin scale only the US is colored, while the rest of the world maps stays white.

index="someindex*" what=tagged | stats count by country_code |  rename country_code AS iso2 |lookup geo_attr_countries iso2 OUTPUT country |  fields+ count, country, geom | geom geo_countries featureIdField="country"

regards,
Pascal

Re: country code to Choropleth ?

DalJeanis — Fri, 24 Mar 2017 21:06:47 GMT

Okay, you are trying to use 2-digit country_code but feeding them in as country, which is a different field...

Try this -

 index="someindex*" what=tagged 
| lookup geo_countries longitude as Longitude, latitude as Latitude OUTPUT country
| top limit=20 country 
| geom geo_countries featureIdField="country"

Reference-
https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html

Re: country code to Choropleth ?

posinga — Sat, 25 Mar 2017 08:32:41 GMT

Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table.
The search job has failed due to an error. You may be able view the job in the Job Inspector.