Archive

Is it possible to use a countrycode "US" for the geom command?

Motivator

Hi,

is it possible to use countrycodes like US, GB, CN for the geom command instead of ip or long/lat?

Thanks in advance
Heinz

Tags (2)
1 Solution

SplunkTrust
SplunkTrust

Yes, you need one step in between though.
The default geo_countries geospatial lookup has a featureId based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default geo_attr_countries lookup like so:

| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

First line sets up dummy data, second line does the conversion, third line calls geom. Visualize using Choropleth for pretty colours.

View solution in original post

SplunkTrust
SplunkTrust

Yes, you need one step in between though.
The default geo_countries geospatial lookup has a featureId based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default geo_attr_countries lookup like so:

| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

First line sets up dummy data, second line does the conversion, third line calls geom. Visualize using Choropleth for pretty colours.

View solution in original post

Motivator

The example works fine for me, but my search does not for some reason.

| stats count by geoip_country_code
| rename geoip_country_code AS iso2
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

The statistics tab shows a correct country column and a filled geom column. But the Choropleth doesn't show the data.

0 Karma

SplunkTrust
SplunkTrust

Is there any legend in the bottom right of the Choropleth map?
Any difference between the tables generated by my example and your tables?

0 Karma

Motivator

It seems, that there have been to many fields in the output of my search.

Using | fields+ count, country, geom before the geom command works fine now.
Thanks a lot!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!