GEOSTATS Rename value lat and lon in piechart

[4nton10]

Hi everyone.

I am generating a cluster map which to make a count by log_subtype and in the map itself shows me the county and the latitude and longitude data.

The question here is whether I can replace the latitude and longitude data with the name of the country.

I have the query as follows:

| iplocation client_ip
| geostats count by log_subtype

[bowesmana]

You can't replace the lat/long, but you can add country to the log_subtype, i.e.

| iplocation client_ip
| eval type=log_subtype." (".Country.")"
| geostats count by type

[inventsekar]

Hi @4nton10

Thru geostats, it may be a long route, maybe please try "choropleth" maps

https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/ChoroplethGenerate