How to apply colors of a choropleth map on a field other than count?

[hylam]

Choropleth map applies different colors depending on the range of the "count" field. How can I use another field? If I have 4 distinct string values in the colorField, how can I set the 4 colors in hex?

[mporath_splunk · Accepted solution]

In the format dropdown you can use the "Categorical" Color Mode in the "Color" tab.
That gives you a different color for each string value.

If you need to customize the color mapping, there's two ways to do that:

• Explicitly define the mapping by setting mapping.fieldColors in Simple XML, e.g. {"1. low":0xFF0000,"2. medium":0xFFFF00,"3. high":0x00FF00}
• Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

[splunk68]

I went for the solution:
Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]

To make it work for my purpose, I had to use a case statement (https://answers.splunk.com/answers/666322/edit-legend-from-choropleth-map-chart.html) to first generate all the categories, then sort them from the lowest to the highest, so that it can match the color order in the mapping.seriesColors.
1: Less 100 would get 0x00FF00 (green)
2: 100 to 500 would get 0xFFFF00 (yellow)
3: Over 500" would get 0xFF0000 (red)

Here a simplified example (as I had to do that for 9 categories...)
| eval count=case(count<100, "1: Less 100", (count>=100 AND count<500), "2: 100 to 500", count>500, "3: Over 500")
| sort +count
| geom geo_countries featureIdField=country

But honestly it's a pain. The proper way should be to be able to use sequential color mode and then be able to customize the data ranges for the legend.

[hylam]

How can I use another field? How can I use a "colorField" other than "count"? I need the count field IN THE TOOLTIP to show something other than the color or the number mapped to the color when I mouseover.

colorField=red count=1
colorField=green count=1
colorField=blue count=1

[mporath_splunk]

Unfortunately that's not possible right now with maps alone. However, you can always setup a contextual drilldown and show additional information in an adjacent panel.

[hylam]

mark as answer