Hi all,
I wrote a SPL query to generate the table to be used as data source for a world choropleth map within my glass table on Splunk Cloud with the ITSI app.
The query is defined as follows:
index=test
| rename country as iso2
| stats count by iso2
| lookup geo_attr_countries iso2 OUTPUT country
| fields - iso2
| geom geo_countries featureIdField="country"
It runs well in the search interface (both on a Splunk Cloud instance without ITSI and with ITSI) and in a world choropleth map on a "traditional" Splunk dashboard: the country are always colored as expected.
However, when I add this query in the data configuration section of a new world choropleth map on a new glass table in the ITSI app, I get only a message of "Cannot get geoJson data.".
I supposed the glass table cannot find the data, but if I use the same query in another visualization type (e.g. table), the data are displayed as expected. Data are correct and the query works well even if I click on "open in search" near the empty widget of the map while in visualization mode.
Could you please support me in resolving this issue? I couldn't find any suggestion or example online for choropleth maps in glass tables.
Thanks,
G.P.
