Dashboards & Visualizations

Why does choropleth map does not render in Dashboard Studio but it does in Classic Dashboards?

cyriac
Engager

I need to plot a world map and color the countries based on the count and display it on the Studio dashboard. This is my query.

...<ommitted> AS iso2
| search iso2=*
| stats count by iso2
| lookup geo_attr_countries iso2 OUTPUT country
| fields+ count, country
| geom geo_countries featureIdField="country"

This works fine on the search page. When Visualization=Choropleth Map is chosen it is plotted correctly.  I then add it on a Classic Dashboard type dashboard, which works fine.

But when I add the same query to a Dashboard Studio dashboard, it doesn't work. I get this error.

Cannot read properties of undefined (reading 'warn')

How to fix this?

Labels (1)
Tags (2)
0 Karma
1 Solution

cyriac
Engager
 
Know your data columns
When you create a search to generate a choropleth map, the search will have a column of fields, usually states, countries, or regions. This column is usually equivalent to the setting primary[0], the first column of results. There should be at least one more column that relates a numeric value to each field in the first column (color for NULL values can also be configured). This is often, but not always, the second column in the search results, equivalent to the setting primary[1]. If the number values you want to use are in a different column, use the equivalent setting primary[n-1] where n equals the number of the column.

 

Documentation - https://docs.splunk.com/Documentation/Splunk/9.1.0/DashStudio/mapsChor

As per this, I modified my query to the one below and it worked

| fields+ country, count

 

View solution in original post

0 Karma

cyriac
Engager
 
Know your data columns
When you create a search to generate a choropleth map, the search will have a column of fields, usually states, countries, or regions. This column is usually equivalent to the setting primary[0], the first column of results. There should be at least one more column that relates a numeric value to each field in the first column (color for NULL values can also be configured). This is often, but not always, the second column in the search results, equivalent to the setting primary[1]. If the number values you want to use are in a different column, use the equivalent setting primary[n-1] where n equals the number of the column.

 

Documentation - https://docs.splunk.com/Documentation/Splunk/9.1.0/DashStudio/mapsChor

As per this, I modified my query to the one below and it worked

| fields+ country, count

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...