Dear All,
I have a dashboard with Choropleth map presenting established connection from various countries.
| index=*** sourcetype=*** bla bla
| bla bla bla
| iplocation IP
| table Time Username IP Country
| stats count by Country
| eval count=case(count < 10, "1:Less than 10", (count > 10 AND count <= 20), "2:Between 10 to 20", (count > 20 AND count <= 50), "3:Between 21 to 50", (count > 51 AND count <= 100), "4:Between 51 to 100", (count > 100 AND count <= 500), "5:Between 101 to 500",(count > 500), "6:More than 500")
| sort +count
| geom geo_countries featureIdField=Country
In the legend, I see colours with the count of established connections.
May I edit the legend in a way that the name of each country will be shown up and along with count?
I have spent many days googling but unfortunately I am unable to get the answer.
I also tried with Cluster Map visualization, but unfortunately, no luck for me.
Thank you very much in advanced for your advices.
| index=*** sourcetype=*** bla bla
| bla bla bla
| rename ext_device as VPN, ext_when as Time, ext_Username as Username, ext_IP_addr as IP
| iplocation IP
| geostats count by Country
