country code to Choropleth ?

[posinga]

I'm trying to get country codes in to the Choropleth map, but i'm a bit stuck.
I'm using the following search

index="someindex*" what=tagged | lookup geo_countries longitude as Longitude, latitude as Latitude | top limit=20 country_code  | rename country_code to country  | geom geo_countries featureIdField="country"

The output is as follows

How can I get the colors / numbers on the map with this set of data ?

*Update *
With the following query i'm able to get the stats in the map. Though since you cannot change the bin scale only the US is colored, while the rest of the world maps stays white.

index="someindex*" what=tagged | stats count by country_code |  rename country_code AS iso2 |lookup geo_attr_countries iso2 OUTPUT country |  fields+ count, country, geom | geom geo_countries featureIdField="country"

regards,
Pascal

[DalJeanis]

Okay, you are trying to use 2-digit country_code but feeding them in as country, which is a different field...

Try this -

 index="someindex*" what=tagged 
| lookup geo_countries longitude as Longitude, latitude as Latitude OUTPUT country
| top limit=20 country 
| geom geo_countries featureIdField="country"

Reference-
https://answers.splunk.com/answers/378193/is-it-possible-to-use-a-countrycode-us-for-the-geo.html

[posinga]

Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table.
The search job has failed due to an error. You may be able view the job in the Job Inspector.