Dashboards & Visualizations

Choropleth Maps using static colors

dcondliffe
Engager

Here is the search (redacted a little)..

| inputlookup xxxxxxxxx_xxxxxx.csv
| search Area_designation="$status$"
| rename "Site Designation" as Site_designation
| stats count by Country
| geom geo_countries allFeatures=True featureIdField=Country

The $status$ token has a possible five values, I want to assign a color to each of the values.

I have seen a response from 2015 that indicates it is possible, but have not been able to make it work..

0 Karma

to4kawa
Ultra Champion

see reference:
https://docs.splunk.com/Documentation/Splunk/latest/Viz/GenerateMap#Generate_and_configure_your_chor...
https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#map

<map>
<option name="mapping.fieldColors">{foo:0xFF0000,bar:0x00FF00}</option>
<option name="mapping.seriesColors">[0x0000FF]</option>
</map>

and previous answers:
https://answers.splunk.com/answers/313032/how-to-apply-colors-of-a-choropleth-map-on-a-field.html

and another use case:
https://github.com/carbonblack/cb-defense-splunk-app/blob/master/DA-ESS-CbDefense/default/data/ui/vi...

If your simpleXML doesn't work, please provide your simpleXML.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...