Community Blog
Get the latest updates on the Splunk Community, including member experiences, product education, events, and more!

How to create a Quick Highlighted map of States in Splunk

atoulme
Splunk Employee
Splunk Employee

Hello! I am an Engineering Manager on the Blockchain & DLT team and I wanted to share a project I recently created. I made a quick map of US States which would highlight my current team’s location.

Here is the end result:

atoulme_0-1654119338966.png

The challenge was to display multiple states at once. The documentation is helpful when it comes to highlighting just one element on the map:

 

 

 

 

 

| stats count | eval featureId="California" | eval count=10000 | geom geo_us_states allFeatures=true

 

 

 

 

 

To display multiple results, we will need multiple results.

So first off, let’s use makeresults to create results for our query.

makeresults has a fun example to create multiple events:

 

 

 

 

 

| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test 
| mvexpand test

 

 

 

 

 

We can use that with a list of US states instead:

 

 

 

 

 

| makeresults
| eval test="California Florida Colorado New Mexico"
| makemv delim=" " test 
| mvexpand test

 

 

 

 

 

We rename test to featureId and pass it to geom:

 

 

 

 

 

| makeresults
| eval featureId="California Florida Colorado New Mexico"
| makemv delim=" " featureId 
| mvexpand featureId
|eval count=10000
| geom geo_us_states allFeatures=true

 

 

 

 

 

It almost works, but New Mexico is not showing. That’s because we use a space delimiter. Let’s try to separate values with an underscore instead:

 

 

 

 

 

| makeresults
| eval featureId="California_Florida_Colorado_New Mexico"
| makemv delim="_" featureId
| mvexpand featureId
| eval count=10000
| geom geo_us_states allFeatures=true

 

 

 

 

 

Our map now shows values correctly.

Was this article helpful to you? Would you like to learn more about SPL techniques?

.conf22 is coming up ! Sign up now to join in Las Vegas or remotely. We will be traveling from all the states highlighted on the map to talk about blockchain, so make sure to read about and attend our talk, workshop and NFT activities!

— Antoine Toulme,  Senior Engineering Manager, Blockchain & DLT

Tags (3)
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...