Hi,
I am pretty new to Splunk and need some help with the Choropleth maps.
I have a requirement to present the transaction charge volume per country as a choropleth map in my Splunk dashboard.
I am using a csv lookup to read the values from a csv.
The fields are:
1. "market" with values - USA, Australia, UK, Germany, Spain and France
2. "Charge Volume" - for multiple clients per market
When I search using the following, I am getting the desired search result:
| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| geom geo_countries featureIdField="Country"
Result:
But in visualization, I do not get any colors on the map.
I have set the format as "Categorical".
I need help with following:
Country name should be camel case , check the below sample,
|makeresults | eval Country=split("India,France,Spain,Germany",",") | mvexpand Country | streamstats count | geom geo_countries featureIdField="Country"
Check your results are giving any geom field with values or empty, looks like you are not getting any geom values. Try to change the values and check.
Expected : Spain
Apart from any values SPAIN / spain ,, seems not working.
Country name should be camel case , check the below sample,
|makeresults | eval Country=split("India,France,Spain,Germany",",") | mvexpand Country | streamstats count | geom geo_countries featureIdField="Country"
Check your results are giving any geom field with values or empty, looks like you are not getting any geom values. Try to change the values and check.
Expected : Spain
Apart from any values SPAIN / spain ,, seems not working.
Thanks Vasanth !
It works beautifully 🙂
@aartivig289 - Please "Accept" the answer by vasanthmss to resolve your question. Thanks.
Thanks Vasanth.
I was getting empty geom field before.
I updated my query as follows:
| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| eval Country=split("USA,United Kingdom,Spain,France,Germany, Australia",",") |mvexpand Country| geom geo_countries featureIdField="Country"
I am now getting same one charge volume value against all 6 markets, for all the different values of Charge volume. No Geom is getting generated for USA and Australia
Also, Only one charge volume value is getting highlighted in the chloropeth for Spain, France, Germany and UK.
Try this search,
| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country"
Thanks Vasanth
Earlier the search was giving an empty Geom field.
Now I updated my query to:
| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| eval Country=split("USA,United Kingdom,Spain,France,Germany",",") |mvexpand Country| geom geo_countries featureIdField="Country"
Because of the Split, I am getting the sum of charge volumes for one country against all others as well. Also the chloropeth is showing a single color for countries since it is considering the highest charge volume for all markets.
| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country"
I have changed only France and Australia . Try to change the others,