Dashboards & Visualizations

Choropleth map - Country as legends


Dear All,

I have a dashboard with Choropleth map presenting established connection from various countries.

| index=*** sourcetype=***  bla bla 
| bla bla bla
| iplocation IP
| table Time Username IP Country
| stats count by Country
| eval count=case(count < 10, "1:Less than 10", (count > 10 AND count <= 20), "2:Between 10 to 20", (count > 20 AND count <= 50), "3:Between 21 to 50", (count > 51 AND count <= 100), "4:Between 51 to 100", (count > 100 AND count <= 500), "5:Between 101 to 500",(count > 500), "6:More than 500")
| sort +count
| geom geo_countries featureIdField=Country


In the legend, I see colours with the count of established connections.

May I edit the legend in a way that the name of each country will be shown up and along with count?
I have spent many days googling but unfortunately I am unable to get the answer.

I also tried with Cluster Map visualization, but unfortunately, no luck for me.
Thank you very much in advanced for your advices.

| index=*** sourcetype=***  bla bla 
| bla bla bla
| rename ext_device as VPN, ext_when as Time, ext_Username as Username, ext_IP_addr as IP
| iplocation IP
| geostats count by Country

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...