Dashboards & Visualizations

geom column not populated in the Statistics tab

chintan_shah
Path Finder

I am trying to create a Choropleth map for US states where i am trying to show the number of sales per States, my SPL is:
stats count(sales) as Sales by STATE_CD |geom geo_us_states featureIdField=STATE_CD but trying to run it,
the geom tab in Statistics is not getting populated and the Visualizations shows the US maps but the color are not present.
Can someone please help me out where i am missing, do i need to configure anything else?

alt text

Tags (2)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

You will need to have the State names where AZ = Arizona and not the abbreviations if I remember correctly. Perhaps you can fix the data or you can just use a lookup to automatically create a State field based on the STATE_CD field.

I just tried this on some quick data and it works fine....

index=* | stats count by State | geom geo_us_states featureIdField="State"

alt text

View solution in original post

chintan_shah
Path Finder

Thanks dmaislin, it worked

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Excellent! Please upgoat my answer!

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

You will need to have the State names where AZ = Arizona and not the abbreviations if I remember correctly. Perhaps you can fix the data or you can just use a lookup to automatically create a State field based on the STATE_CD field.

I just tried this on some quick data and it works fine....

index=* | stats count by State | geom geo_us_states featureIdField="State"

alt text

jzapantis
Path Finder

Can you please explain when to use: featureIdField="" - and also what should be put in place of field? What conditions must be met for a field to be used as a featureIdField?

Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...