Splunk Search

How to customize legend on choropleth map?

dgoamaral
Engager

Hello folks,

Please help me figure out how to customize the legend values of my choropleth map. I'd like to get the average logon duration of each device and then have a choropleth map (which is working based on country) and set legend green if avg_logon_duration was equal or lower than 10; yellow if it was between 11 and 20 and red if greater or equal to 21.

Here is my current table structure:

countrydevicelogon_duration
BrazilXYZ0121.05
USAABC0116.99
GermanyFE-015.75
IndiaMUM0110.00

 

I've already tried to use rangemap and also editing XML with mapping.fieldColors ({"green":0xFF0000,"yellow":0xFFFF00,"red":0x00FF00}) which I found in another article, but it did not work.

Here is my last code:

 

 

 

| stats avg(logon_duration) as avg_logon_duration by CountryName
| geom geo_countries featureIdField=CountryName 
| rangemap field=avg_logon_duration green=0-10 yellow=11-20 red=21-99 default=white

 

 

 

The closest I got so far was using mapping.seriesColors with colors array [0xFF0000,0xFFFF00,0x00FF00], but it completely ignores the categorical values I choose on the choropleth map.

Any help would be really appreciated.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See this example dashboard using your example data

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <map>
        <search>
          <query>| makeresults
| eval _raw="country,device,logon_duration
Brazil,XYZ01,21.05
United States,ABC01,16.99
Germany,FE-01,5.75
India,MUM01,10.00"
| multikv forceheader=1
| eval CountryName=country
| rangemap field=logon_duration green=0-10 yellow=11-20 red=21-99 default=white
| fields CountryName range
| sort range
| geom geo_countries featureIdField=CountryName
          </query>
          <earliest>0</earliest>
        </search>
        <option name="drilldown">all</option>
        <option name="height">600</option>
        <option name="mapping.choroplethLayer.colorBins">4</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.minimumColor">0x53a051</option>
        <option name="mapping.choroplethLayer.neutralPoint">50</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.85</option>
        <option name="mapping.map.center">(17.98,4.57)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.seriesColors">[0x00FF00, 0xFF0000, 0xFFFF00, 0x000000 ]</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.tileOpacity">0.7</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
        <option name="mapping.type">choropleth</option>
      </map>
    </panel>
  </row>
</dashboard>

The seriesColors will reflect the SORTED values of the range field, so G R Y W for your colours reflect the ordering of the colours in that setting. Note if you do not do the 'sort range' it will change the colours.

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

See this example dashboard using your example data

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <map>
        <search>
          <query>| makeresults
| eval _raw="country,device,logon_duration
Brazil,XYZ01,21.05
United States,ABC01,16.99
Germany,FE-01,5.75
India,MUM01,10.00"
| multikv forceheader=1
| eval CountryName=country
| rangemap field=logon_duration green=0-10 yellow=11-20 red=21-99 default=white
| fields CountryName range
| sort range
| geom geo_countries featureIdField=CountryName
          </query>
          <earliest>0</earliest>
        </search>
        <option name="drilldown">all</option>
        <option name="height">600</option>
        <option name="mapping.choroplethLayer.colorBins">4</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.minimumColor">0x53a051</option>
        <option name="mapping.choroplethLayer.neutralPoint">50</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.85</option>
        <option name="mapping.map.center">(17.98,4.57)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.seriesColors">[0x00FF00, 0xFF0000, 0xFFFF00, 0x000000 ]</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.tileOpacity">0.7</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
        <option name="mapping.type">choropleth</option>
      </map>
    </panel>
  </row>
</dashboard>

The seriesColors will reflect the SORTED values of the range field, so G R Y W for your colours reflect the ordering of the colours in that setting. Note if you do not do the 'sort range' it will change the colours.

 

0 Karma

dgoamaral
Engager

That works! Thanks a lot! 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...