Dashboards & Visualizations

Choropleth Map in Glass Table not working


Hi all,

I wrote a SPL query to generate the table to be used as data source for a world choropleth map within my glass table on Splunk Cloud with the ITSI app.

The query is defined as follows:

| rename country as iso2
| stats count by iso2
| lookup geo_attr_countries iso2 OUTPUT country
| fields - iso2
| geom geo_countries featureIdField="country"

It runs well in the search interface (both on a Splunk Cloud instance without ITSI and with ITSI) and in a world choropleth map on a "traditional" Splunk dashboard: the country are always colored as expected.

However, when I add this query in the data configuration section of a new world choropleth map on a new glass table in the ITSI app, I get only a message of "Cannot get geoJson data.".

I supposed the glass table cannot find the data, but if I use the same query in another visualization type (e.g. table), the data are displayed as expected. Data are correct and the query works well even if I click on "open in search" near the empty widget of the map while in visualization mode.

Could you please support me in resolving this issue? I couldn't find any suggestion or example online for choropleth maps in glass tables.



Labels (2)


Any Resolution, been having an identical problem 


0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...