Splunk Search

How to apply colors of a choropleth map on a field other than count?

Contributor

Choropleth map applies different colors depending on the range of the "count" field. How can I use another field? If I have 4 distinct string values in the colorField, how can I set the 4 colors in hex?

1 Solution

Splunk Employee
Splunk Employee

In the format dropdown you can use the "Categorical" Color Mode in the "Color" tab.
That gives you a different color for each string value.

If you need to customize the color mapping, there's two ways to do that:

  • Explicitly define the mapping by setting mapping.fieldColors in Simple XML, e.g. {"1. low":0xFF0000,"2. medium":0xFFFF00,"3. high":0x00FF00}
  • Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

View solution in original post

Splunk Employee
Splunk Employee

In the format dropdown you can use the "Categorical" Color Mode in the "Color" tab.
That gives you a different color for each string value.

If you need to customize the color mapping, there's two ways to do that:

  • Explicitly define the mapping by setting mapping.fieldColors in Simple XML, e.g. {"1. low":0xFF0000,"2. medium":0xFFFF00,"3. high":0x00FF00}
  • Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

View solution in original post

Path Finder

I went for the solution:
Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

To make it work for my purpose, I had to use a case statement (https://answers.splunk.com/answers/666322/edit-legend-from-choropleth-map-chart.html) to first generate all the categories, then sort them from the lowest to the highest, so that it can match the color order in the mapping.seriesColors.
1: Less 100 would get 0x00FF00 (green)
2: 100 to 500 would get 0xFFFF00 (yellow)
3: Over 500" would get 0xFF0000 (red)

Here a simplified example (as I had to do that for 9 categories...)
| eval count=case(count<100, "1: Less 100", (count>=100 AND count<500), "2: 100 to 500", count>500, "3: Over 500")
| sort +count
| geom geo_countries featureIdField=country

But honestly it's a pain. The proper way should be to be able to use sequential color mode and then be able to customize the data ranges for the legend.

0 Karma

Contributor

How can I use another field? How can I use a "colorField" other than "count"? I need the count field IN THE TOOLTIP to show something other than the color or the number mapped to the color when I mouseover.

colorField=red count=1
colorField=green count=1
colorField=blue count=1

0 Karma

Splunk Employee
Splunk Employee

Unfortunately that's not possible right now with maps alone. However, you can always setup a contextual drilldown and show additional information in an adjacent panel.

0 Karma

Contributor

mark as answer

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!