topic How to revise my search in order to convert my cluster map into a choropleth map? in Splunk Search

How to revise my search in order to convert my cluster map into a choropleth map?

dbcase — Tue, 20 Sep 2016 20:07:52 GMT

Hi,

I have a query that supplies IP address and a status code and I have created a cluster map from the results

host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|rex "HTTP.\d.\d.\s+(?<status>\d+)"| iplocation src  |geostats count by status

I'd like to convert this to a choropleth map but so far no luck. As this is my first time trying this I'm kinda stuck.

Re: How to revise my search in order to convert my cluster map into a choropleth map?

sundareshr — Tue, 20 Sep 2016 20:21:06 GMT

I think, for choropleth maps, you will need geo_* kmz files. Check your lookup definition, there should be a few. Pick the one that's appropriate for your data (countries, states etc). Then your query would look something like this (you'll have to tweak it)

host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex "HTTP.\d.\d.\s+(?<status>\d+)" | iplocation src  | lookup geo_countries latitude AS lat, longitude AS long | stats count BY featureIdField AS country | geom geo_countries featureIdField="country"

Re: How to revise my search in order to convert my cluster map into a choropleth map?

dbcase — Tue, 20 Sep 2016 20:44:33 GMT

Hi Sundareshr,

I think with your help I got it to work. Had to make a few changes on your query. It ended up looking like this

host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex "HTTP.\d.\d.\s+(?<status>\d+)" | iplocation src  | lookup geo_countries latitude AS lat, longitude AS lon |stats count BY featureId|geom geo_countries featureId="country"