Dashboards & Visualizations

Choropleth Map with values instead of count

bosch_softtec
Path Finder

Hi,
I like to setup a choropleth map but I'm not able to build this map by the vales of a zone. I only got it working by counting the country's which results in value=1.

My search looks like:

| inputcsv Region.csv  | join max=0 Region [inputcsv ISO_3166_Codes_Lat_Long.csv ] | stats count by Country | geom geo_countries featureIdField="Country"

Region.csv file contains the country code and the number of clients. It looks like:

Region,Number
DE,51
GB,154
US,197

After the join I get all needed informations to setup the map but the result is:

Country        | count | ...
Germany        | 1     | ...
United Kingdom | 1     | ...
United States  | 1     | ...

I like to get:

Country        | count | ...
Germany        | 51    | ...
United Kingdom | 154   | ...
United States  | 197   | ...

I tried it with:

| inputcsv Region.csv  | join max=0 Region [inputcsv ISO_3166_Codes_Lat_Long.csv ] | stats values(Number) by Country | geom geo_countries

But the map won't be coloured.

Any idea how to solve this?

Thank's for your ideas and help
Best regards
Thorsten

Tags (1)
0 Karma
1 Solution

gokadroid
Motivator

Since I don't have the data to plot similar stuff but If there is only one Number value per country you can you please try this and see if it works out:

...| chart max(Number) by Country | geom geo_countries featureIdField="Country"

View solution in original post

0 Karma

bosch_softtec
Path Finder

Hi gokadroid, thanks for you answer, it's working :slightly_smiling_face:

gokadroid
Motivator

Since I don't have the data to plot similar stuff but If there is only one Number value per country you can you please try this and see if it works out:

...| chart max(Number) by Country | geom geo_countries featureIdField="Country"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...