I currently use a GEO map, that meets most of my requested outcome, but was asked if we can swap to a choropleth map for better visualization and data.
Using this search, I get the below:
index="Foo" NOT Error="0" | iplocation allfields=true IPAddress | geostats globallimit=0 count by Error
Using this search, I get the below.
index="Foo" NOT Error="0"
| iplocation IPAddress
| stats count(Error) by Region
| geom geo_us_states featureIdField=Region
Somewhere I am missing how to change it to get it to show the number of each error type, when hovering over the state.
Also, you may be interested in another map viz. called clustered single value map visualization. You get it by clicking on "find more visualizations" in the visualization name drop down... or via the app manager / splunkbase.
With it I was able to work some magic and get multiple markers for each EventCode in the event logs i have in my main index. In this case i had 4 events with EventCode 1001 which "happened" in new york.
... | iplocation src_ip | rename lon AS longitude lat as latitude | stats count(EventCode) as Count by EventCode latitude, longitude | eval description=mvzip(EventCode,Count) | table latitude longitude description