https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239819#M188768 <P>Hi,</P> <P>is it possible to use countrycodes like US, GB, CN for the geom command instead of ip or long/lat?</P> <P>Thanks in advance<BR /> Heinz</P> Thu, 10 Mar 2016 14:25:36 GMT HeinzWaescher 2016-03-10T14:25:36Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239819#M188768 <P>Hi,</P> <P>is it possible to use countrycodes like US, GB, CN for the geom command instead of ip or long/lat?</P> <P>Thanks in advance<BR /> Heinz</P> Thu, 10 Mar 2016 14:25:36 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239819#M188768 HeinzWaescher 2016-03-10T14:25:36Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239820#M188769 <P>Yes, you need one step in between though.<BR /> The default <CODE>geo_countries</CODE> geospatial lookup has a <CODE>featureId</CODE> based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default <CODE>geo_attr_countries</CODE> lookup like so:</P> <PRE><CODE>| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count | lookup geo_attr_countries iso2 OUTPUT country | geom geo_countries featureIdField="country" </CODE></PRE> <P>First line sets up dummy data, second line does the conversion, third line calls <CODE>geom</CODE>. Visualize using Choropleth for pretty colours.</P> Thu, 10 Mar 2016 22:43:36 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239820#M188769 martin_mueller 2016-03-10T22:43:36Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239821#M188770 <P>The example works fine for me, but my search does not for some reason.</P> <P>| stats count by geoip_country_code<BR /> | rename geoip_country_code AS iso2<BR /> | lookup geo_attr_countries iso2 OUTPUT country<BR /> | geom geo_countries featureIdField="country"</P> <P>The statistics tab shows a correct country column and a filled geom column. But the Choropleth doesn't show the data. </P> Tue, 29 Sep 2020 09:02:29 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239821#M188770 HeinzWaescher 2020-09-29T09:02:29Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239822#M188771 <P>Is there any legend in the bottom right of the Choropleth map?<BR /> Any difference between the tables generated by my example and your tables?</P> Fri, 11 Mar 2016 23:14:56 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239822#M188771 martin_mueller 2016-03-11T23:14:56Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239823#M188772 <P>It seems, that there have been to many fields in the output of my search.</P> <P>Using <EM>| fields+ count, country, geom</EM> before the geom command works fine now.<BR /> Thanks a lot!</P> Mon, 21 Mar 2016 09:50:04 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-a-countrycode-quot-US-quot-for-the-geom/m-p/239823#M188772 HeinzWaescher 2016-03-21T09:50:04Z