topic Re: Why am I not seeing any colors in my choropleth map? in Dashboards & Visualizations

Why am I not seeing any colors in my choropleth map?

aartivig289 — Fri, 07 Jul 2017 20:07:17 GMT

Hi,

I am pretty new to Splunk and need some help with the Choropleth maps.
I have a requirement to present the transaction charge volume per country as a choropleth map in my Splunk dashboard.
I am using a csv lookup to read the values from a csv.
The fields are:
1. "market" with values - USA, Australia, UK, Germany, Spain and France
2. "Charge Volume" - for multiple clients per market

When I search using the following, I am getting the desired search result:

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| geom geo_countries featureIdField="Country"

Result:

But in visualization, I do not get any colors on the map.
I have set the format as "Categorical".
I need help with following:

I am not getting any colors on the map for the 6 countries I mentioned above.
In the legend I need the country name with charge volume against each color.

Re: Why am I not seeing any colors in my choropleth map?

vasanthmss — Fri, 07 Jul 2017 20:36:43 GMT

Country name should be camel case , check the below sample,

|makeresults | eval Country=split("India,France,Spain,Germany",",") | mvexpand Country  | streamstats count   | geom geo_countries  featureIdField="Country"

Check your results are giving any geom field with values or empty, looks like you are not getting any geom values. Try to change the values and check.

Expected : Spain
Apart from any values SPAIN / spain ,, seems not working.

Re: Why am I not seeing any colors in my choropleth map?

aartivig289 — Fri, 07 Jul 2017 21:00:53 GMT

Thanks Vasanth
Earlier the search was giving an empty Geom field.

Now I updated my query to:

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| eval Country=split("USA,United Kingdom,Spain,France,Germany",",") |mvexpand Country| geom geo_countries featureIdField="Country"

Because of the Split, I am getting the sum of charge volumes for one country against all others as well. Also the chloropeth is showing a single color for countries since it is considering the highest charge volume for all markets.

Re: Why am I not seeing any colors in my choropleth map?

aartivig289 — Fri, 07 Jul 2017 21:13:00 GMT

Thanks Vasanth.
I was getting empty geom field before.

I am now getting same one charge volume value against all 6 markets, for all the different values of Charge volume. No Geom is getting generated for USA and Australia

Also, Only one charge volume value is getting highlighted in the chloropeth for Spain, France, Germany and UK.

Re: Why am I not seeing any colors in my choropleth map?

vasanthmss — Fri, 07 Jul 2017 21:19:11 GMT

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country"

I have changed only France and Australia . Try to change the others,

Re: Why am I not seeing any colors in my choropleth map?

aartivig289 — Fri, 07 Jul 2017 21:27:42 GMT

Thanks Vasanth !
It works beautifully 🙂

Re: Why am I not seeing any colors in my choropleth map?

vasanthmss — Fri, 07 Jul 2017 21:29:03 GMT

Try this search,

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country"

Re: Why am I not seeing any colors in my choropleth map?

aaraneta_splunk — Fri, 07 Jul 2017 21:30:02 GMT

@aartivig289 - Please "Accept" the answer by vasanthmss to resolve your question. Thanks.