Dashboards & Visualizations

How to convert at geo map to a choropleth map?

Communicator

I currently use a GEO map, that meets most of my requested outcome, but was asked if we can swap to a choropleth map for better visualization and data.

Using this search, I get the below:

index="Foo" NOT Error="0" | iplocation allfields=true IPAddress |  geostats globallimit=0 count by Error

alt text

Using this search, I get the below.

index="Foo" NOT Error="0"
| iplocation IPAddress
| stats count(Error) by Region
| geom geo_us_states featureIdField=Region

alt text

Somewhere I am missing how to change it to get it to show the number of each error type, when hovering over the state.

Any ideas?

SplunkTrust
SplunkTrust

Also, you may be interested in another map viz. called clustered single value map visualization. You get it by clicking on "find more visualizations" in the visualization name drop down... or via the app manager / splunkbase.

alt text

With it I was able to work some magic and get multiple markers for each EventCode in the event logs i have in my main index. In this case i had 4 events with EventCode 1001 which "happened" in new york.

  ... | iplocation src_ip | rename lon AS longitude lat as latitude | stats count(EventCode) as Count by EventCode latitude, longitude | eval description=mvzip(EventCode,Count) |  table latitude longitude description

alt text

0 Karma

Communicator

Thank you, that did provide interesting visuals, but appears to not be what they wanted created.

0 Karma

SplunkTrust
SplunkTrust

what happens if you try list(Error) in your stats command?

0 Karma

Communicator

If I replace the Count with List, I get each incident of 2020 in a line, for example.

0 Karma

SplunkTrust
SplunkTrust

yeah i tested and it didnt work for me either.

0 Karma