Dashboards & Visualizations

Why am I not seeing any colors in my choropleth map?

aartivig289
Engager

Hi,

I am pretty new to Splunk and need some help with the Choropleth maps.
I have a requirement to present the transaction charge volume per country as a choropleth map in my Splunk dashboard.
I am using a csv lookup to read the values from a csv.
The fields are:
1. "market" with values - USA, Australia, UK, Germany, Spain and France
2. "Charge Volume" - for multiple clients per market

When I search using the following, I am getting the desired search result:

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| geom geo_countries featureIdField="Country"

Result:
alt text

But in visualization, I do not get any colors on the map.
I have set the format as "Categorical".
I need help with following:

  1. I am not getting any colors on the map for the 6 countries I mentioned above.
  2. In the legend I need the country name with charge volume against each color.

alt text

0 Karma
1 Solution

vasanthmss
Motivator

Country name should be camel case , check the below sample,

|makeresults | eval Country=split("India,France,Spain,Germany",",") | mvexpand Country  | streamstats count   | geom geo_countries  featureIdField="Country"

Check your results are giving any geom field with values or empty, looks like you are not getting any geom values. Try to change the values and check.

Expected : Spain
Apart from any values SPAIN / spain ,, seems not working.

V

View solution in original post

vasanthmss
Motivator

Country name should be camel case , check the below sample,

|makeresults | eval Country=split("India,France,Spain,Germany",",") | mvexpand Country  | streamstats count   | geom geo_countries  featureIdField="Country"

Check your results are giving any geom field with values or empty, looks like you are not getting any geom values. Try to change the values and check.

Expected : Spain
Apart from any values SPAIN / spain ,, seems not working.

V

aartivig289
Engager

Thanks Vasanth !
It works beautifully 🙂

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@aartivig289 - Please "Accept" the answer by vasanthmss to resolve your question. Thanks.

0 Karma

aartivig289
Engager

Thanks Vasanth.
I was getting empty geom field before.

I updated my query as follows:
| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| eval Country=split("USA,United Kingdom,Spain,France,Germany, Australia",",") |mvexpand Country| geom geo_countries featureIdField="Country"

I am now getting same one charge volume value against all 6 markets, for all the different values of Charge volume. No Geom is getting generated for USA and Australia
alt text

Also, Only one charge volume value is getting highlighted in the chloropeth for Spain, France, Germany and UK.
alt text

0 Karma

vasanthmss
Motivator

Try this search,

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country"

V

aartivig289
Engager

Thanks Vasanth
Earlier the search was giving an empty Geom field.

Now I updated my query to:

| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country"| eval Country=split("USA,United Kingdom,Spain,France,Germany",",") |mvexpand Country| geom geo_countries featureIdField="Country" 

Because of the Split, I am getting the sum of charge volumes for one country against all others as well. Also the chloropeth is showing a single color for countries since it is considering the highest charge volume for all markets.

alt text
alt text

0 Karma

vasanthmss
Motivator
| inputlookup ChargeVolume.csv | chart sum(Charge Volume (USD)) as "Charge Volume" by Market| Rename "Market" as "Country" | eval Country=case(Country="FRANCE", "France",Country=AUSTRALIA, "Australia" ,1=1,Country) | geom geo_countries featureIdField="Country"

I have changed only France and Australia . Try to change the others,

V
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...