Archive

country code to Choropleth ?

New Member

I'm trying to get country codes in to the Choropleth map, but i'm a bit stuck.
I'm using the following search

index="someindex*" what=tagged | lookup geo_countries longitude as Longitude, latitude as Latitude | top limit=20 country_code  | rename country_code to country  | geom geo_countries featureIdField="country"

The output is as follows
alt text

How can I get the colors / numbers on the map with this set of data ?

*Update *
With the following query i'm able to get the stats in the map. Though since you cannot change the bin scale only the US is colored, while the rest of the world maps stays white.

index="someindex*" what=tagged | stats count by country_code |  rename country_code AS iso2 |lookup geo_attr_countries iso2 OUTPUT country |  fields+ count, country, geom | geom geo_countries featureIdField="country"

alt text

regards,
Pascal

0 Karma

SplunkTrust
SplunkTrust

Okay, you are trying to use 2-digit country_code but feeding them in as country, which is a different field...

Try this -

 index="someindex*" what=tagged 
| lookup geo_countries longitude as Longitude, latitude as Latitude OUTPUT country
| top limit=20 country 
| geom geo_countries featureIdField="country"

Reference-
https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html

0 Karma

New Member

Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!