Dashboards & Visualizations

Choropleth map - Country as legends


Dear All,

I have a dashboard with Choropleth map presenting established connection from various countries.

| index=*** sourcetype=***  bla bla 
| bla bla bla
| iplocation IP
| table Time Username IP Country
| stats count by Country
| eval count=case(count < 10, "1:Less than 10", (count > 10 AND count <= 20), "2:Between 10 to 20", (count > 20 AND count <= 50), "3:Between 21 to 50", (count > 51 AND count <= 100), "4:Between 51 to 100", (count > 100 AND count <= 500), "5:Between 101 to 500",(count > 500), "6:More than 500")
| sort +count
| geom geo_countries featureIdField=Country


In the legend, I see colours with the count of established connections.

May I edit the legend in a way that the name of each country will be shown up and along with count?
I have spent many days googling but unfortunately I am unable to get the answer.

I also tried with Cluster Map visualization, but unfortunately, no luck for me.
Thank you very much in advanced for your advices.

| index=*** sourcetype=***  bla bla 
| bla bla bla
| rename ext_device as VPN, ext_when as Time, ext_Username as Username, ext_IP_addr as IP
| iplocation IP
| geostats count by Country

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...