Dashboards & Visualizations

Customize Legend on Choropleth Map

SplunkMaster22
Loves-to-Learn

I have the following command to create visualization on choropleth map which works but I get only the  categorical color  and volume as legend (without header),  how can I add more column full country name that I retrieve from geo_attr_countried to the legend and if possible with header of the columns?


index=main "registered successfully"
| rex "SFTP_OP_(?<country>(\w{2}))"
| stats count by country
| rename country AS iso2
| lookup geo_attr_countries iso2 OUTPUT country
| stats sum by country
| rename sum(count) AS Volume
| geom geo_countries featureIdField="country"

Basically, if possible, I am trying to get a legend something on the right bottom corner like the one below

Color CategoricalCountry NameVolume
ColorChina 124
ColorBrazil25
   
Labels (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...