topic Help generating a choropleth map using geom command in Splunk Search

Help generating a choropleth map using geom command

heavenisreal — Thu, 02 Jun 2022 00:52:41 GMT

Hi There,

I am trying to generate a choropleth map of US using the following command :
| iplocation final_ip
|search Country = "United States"
|stats count as volume by Region
|rename Region as state
|dedup state
|table state volume
|geom geo_us_states featureIdField="state" allFeatures=True

This gives a response with the fields state, volume, featureCollection, geom and but the map is still empty. Using geostats instead and then doing lookup, does give map but count aka volume is very low . Can you help please ?

@

Re: Help generating a choropleth map using geom command

VatsalJagani — Thu, 02 Jun 2022 05:15:34 GMT

@heavenisreal -Try updating query like this:

I hope this helps!!!

Re: Help generating a choropleth map using geom command

heavenisreal — Thu, 02 Jun 2022 18:36:19 GMT

Hi @VatsalJagani

Thanks so much for your response. I tried out removing those lines as per your suggestion and it still doesn't render the map unfortunately. Do we need geostats for the map to render or should the geom just work as it is .

Regards,

Re: Help generating a choropleth map using geom command

heavenisreal — Thu, 02 Jun 2022 21:23:04 GMT

Update::: Who knew, removing the renaming of stats count as volume would do the trick! Is that expected ? Thanks nevertheless.

Re: Help generating a choropleth map using geom command

VatsalJagani — Fri, 03 Jun 2022 04:12:57 GMT

@heavenisreal - geom should be enough, geostats is a different purpose.

To troubleshoot I would keep removing one line at a time from the search and see the statistics until I see the results in the statistics to see which line of search query has issue.

I hope this helps!!!

Re: Help generating a choropleth map using geom command

VatsalJagani — Fri, 03 Jun 2022 04:15:48 GMT

That's what I mentioned in my query.

Ha:)