Splunk Search

How to customize legend on choropleth map?

dgoamaral
Engager

Hello folks,

Please help me figure out how to customize the legend values of my choropleth map. I'd like to get the average logon duration of each device and then have a choropleth map (which is working based on country) and set legend green if avg_logon_duration was equal or lower than 10; yellow if it was between 11 and 20 and red if greater or equal to 21.

Here is my current table structure:

countrydevicelogon_duration
BrazilXYZ0121.05
USAABC0116.99
GermanyFE-015.75
IndiaMUM0110.00

 

I've already tried to use rangemap and also editing XML with mapping.fieldColors ({"green":0xFF0000,"yellow":0xFFFF00,"red":0x00FF00}) which I found in another article, but it did not work.

Here is my last code:

 

 

 

| stats avg(logon_duration) as avg_logon_duration by CountryName
| geom geo_countries featureIdField=CountryName 
| rangemap field=avg_logon_duration green=0-10 yellow=11-20 red=21-99 default=white

 

 

 

The closest I got so far was using mapping.seriesColors with colors array [0xFF0000,0xFFFF00,0x00FF00], but it completely ignores the categorical values I choose on the choropleth map.

Any help would be really appreciated.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See this example dashboard using your example data

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <map>
        <search>
          <query>| makeresults
| eval _raw="country,device,logon_duration
Brazil,XYZ01,21.05
United States,ABC01,16.99
Germany,FE-01,5.75
India,MUM01,10.00"
| multikv forceheader=1
| eval CountryName=country
| rangemap field=logon_duration green=0-10 yellow=11-20 red=21-99 default=white
| fields CountryName range
| sort range
| geom geo_countries featureIdField=CountryName
          </query>
          <earliest>0</earliest>
        </search>
        <option name="drilldown">all</option>
        <option name="height">600</option>
        <option name="mapping.choroplethLayer.colorBins">4</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.minimumColor">0x53a051</option>
        <option name="mapping.choroplethLayer.neutralPoint">50</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.85</option>
        <option name="mapping.map.center">(17.98,4.57)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.seriesColors">[0x00FF00, 0xFF0000, 0xFFFF00, 0x000000 ]</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.tileOpacity">0.7</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
        <option name="mapping.type">choropleth</option>
      </map>
    </panel>
  </row>
</dashboard>

The seriesColors will reflect the SORTED values of the range field, so G R Y W for your colours reflect the ordering of the colours in that setting. Note if you do not do the 'sort range' it will change the colours.

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

See this example dashboard using your example data

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <map>
        <search>
          <query>| makeresults
| eval _raw="country,device,logon_duration
Brazil,XYZ01,21.05
United States,ABC01,16.99
Germany,FE-01,5.75
India,MUM01,10.00"
| multikv forceheader=1
| eval CountryName=country
| rangemap field=logon_duration green=0-10 yellow=11-20 red=21-99 default=white
| fields CountryName range
| sort range
| geom geo_countries featureIdField=CountryName
          </query>
          <earliest>0</earliest>
        </search>
        <option name="drilldown">all</option>
        <option name="height">600</option>
        <option name="mapping.choroplethLayer.colorBins">4</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.minimumColor">0x53a051</option>
        <option name="mapping.choroplethLayer.neutralPoint">50</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.85</option>
        <option name="mapping.map.center">(17.98,4.57)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.seriesColors">[0x00FF00, 0xFF0000, 0xFFFF00, 0x000000 ]</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.tileOpacity">0.7</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
        <option name="mapping.type">choropleth</option>
      </map>
    </panel>
  </row>
</dashboard>

The seriesColors will reflect the SORTED values of the range field, so G R Y W for your colours reflect the ordering of the colours in that setting. Note if you do not do the 'sort range' it will change the colours.

 

0 Karma

dgoamaral
Engager

That works! Thanks a lot! 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...