Splunk Enterprise

How to change the geo heatmap color based on values?

ips_mandar
Builder

Hi,
Below is my results set-

 

latitude|  longitude|   values
-77.123 |  123.123  |    5 
-77.223 |  123.223  |    51 
-77.323 |  123.323  |    25 

 

 I want to display geo heatmap and based on values field I want to change color on map. like maximum value should be highlighted as red and min value as green. can it be possible to achieve it on map?
Thanks,

Labels (2)
Tags (2)
0 Karma

rnowitzki
Builder

Hi @ips_mandar ,

Your sample locations are pretty close to each other and on the Antarctic Ice shield. 🙂

If you want color regions with Choropleth Map other than on country- or us-states level you will need a lookup for your regions like the ones delivered with Splunk (see | inputlookup geo_countries)

You could use clustered map with your data. I created some examples that are a little bit more away from each other:

| makeresults 
| eval value = "5 51 25" 
| makemv value
| mvexpand value
| eval latitude = case(value=5,-78.123,value=51,-57.223,value=25,-47.323) 
| eval longitude = case(value=5,128.123,value=51,113.223,value=25,111.323)
| geostats sum(value) latfield=latitude longfield=longitude


To color the bubbles, you would have to put the map on a dashboard and edit the source of the dashboard.

Here is an example that you can get inspiration from.

Hope it helps
BR
Ralph

 --
Karma and/or Solution tagging appreciated.

--
Karma and/or Solution tagging appreciated.
0 Karma

ips_mandar
Builder

Thanks @rnowitzki . But I am looking particularly for heatmap to change color w.r.t. values

0 Karma

rnowitzki
Builder

Hi @ips_mandar,

So you don't talk about the geo vizualisations that come with Splunk, but some app like this ?
Never used something like that, but I guess they are customizable to the needs that you describe.

You can color based on the "value" on a country level with out-of-the-box Splunk features, but that doesn
't seem to be your request and with your data it would only color Antarctica as a whole.

| lookup geo_countries latitude longitude OUTPUT featureId AS country
| stats sum(value) by country
| geom geo_countries featureIdField=country


BR
Ralph

 

--
Karma and/or Solution tagging appreciated.
0 Karma

ips_mandar
Builder

Thanks @rnowitzki 

Yes I tried using https://splunkbase.splunk.com/app/3217/
But this app won't have any feature to change color based on values.
I cant use geom command since I don't want to highlight entire region.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!