How to change the geo heatmap color based on values?

[ips_mandar]

Hi,
Below is my results set-

latitude|  longitude|   values
-77.123 |  123.123  |    5 
-77.223 |  123.223  |    51 
-77.323 |  123.323  |    25 

 I want to display geo heatmap and based on values field I want to change color on map. like maximum value should be highlighted as red and min value as green. can it be possible to achieve it on map?
Thanks,

[rnowitzki]

Hi @ips_mandar ,

Your sample locations are pretty close to each other and on the Antarctic Ice shield. 🙂

If you want color regions with Choropleth Map other than on country- or us-states level you will need a lookup for your regions like the ones delivered with Splunk (see | inputlookup geo_countries)

You could use clustered map with your data. I created some examples that are a little bit more away from each other:

| makeresults 
| eval value = "5 51 25" 
| makemv value
| mvexpand value
| eval latitude = case(value=5,-78.123,value=51,-57.223,value=25,-47.323) 
| eval longitude = case(value=5,128.123,value=51,113.223,value=25,111.323)
| geostats sum(value) latfield=latitude longfield=longitude

To color the bubbles, you would have to put the map on a dashboard and edit the source of the dashboard.

Here is an example that you can get inspiration from.

Hope it helps
BR
Ralph

 --
Karma and/or Solution tagging appreciated.

[ips_mandar]

Thanks @rnowitzki . But I am looking particularly for heatmap to change color w.r.t. values

[rnowitzki]

Hi @ips_mandar,

So you don't talk about the geo vizualisations that come with Splunk, but some app like this ?
Never used something like that, but I guess they are customizable to the needs that you describe.

You can color based on the "value" on a country level with out-of-the-box Splunk features, but that doesn
't seem to be your request and with your data it would only color Antarctica as a whole.

| lookup geo_countries latitude longitude OUTPUT featureId AS country
| stats sum(value) by country
| geom geo_countries featureIdField=country

BR
Ralph

[ips_mandar]

Thanks @rnowitzki 

Yes I tried using https://splunkbase.splunk.com/app/3217/
But this app won't have any feature to change color based on values.
I cant use geom command since I don't want to highlight entire region.