Splunk Search

How to customize legend on choropleth map?

dgoamaral
Engager

Hello folks,

Please help me figure out how to customize the legend values of my choropleth map. I'd like to get the average logon duration of each device and then have a choropleth map (which is working based on country) and set legend green if avg_logon_duration was equal or lower than 10; yellow if it was between 11 and 20 and red if greater or equal to 21.

Here is my current table structure:

countrydevicelogon_duration
BrazilXYZ0121.05
USAABC0116.99
GermanyFE-015.75
IndiaMUM0110.00

 

I've already tried to use rangemap and also editing XML with mapping.fieldColors ({"green":0xFF0000,"yellow":0xFFFF00,"red":0x00FF00}) which I found in another article, but it did not work.

Here is my last code:

 

 

 

| stats avg(logon_duration) as avg_logon_duration by CountryName
| geom geo_countries featureIdField=CountryName 
| rangemap field=avg_logon_duration green=0-10 yellow=11-20 red=21-99 default=white

 

 

 

The closest I got so far was using mapping.seriesColors with colors array [0xFF0000,0xFFFF00,0x00FF00], but it completely ignores the categorical values I choose on the choropleth map.

Any help would be really appreciated.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See this example dashboard using your example data

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <map>
        <search>
          <query>| makeresults
| eval _raw="country,device,logon_duration
Brazil,XYZ01,21.05
United States,ABC01,16.99
Germany,FE-01,5.75
India,MUM01,10.00"
| multikv forceheader=1
| eval CountryName=country
| rangemap field=logon_duration green=0-10 yellow=11-20 red=21-99 default=white
| fields CountryName range
| sort range
| geom geo_countries featureIdField=CountryName
          </query>
          <earliest>0</earliest>
        </search>
        <option name="drilldown">all</option>
        <option name="height">600</option>
        <option name="mapping.choroplethLayer.colorBins">4</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.minimumColor">0x53a051</option>
        <option name="mapping.choroplethLayer.neutralPoint">50</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.85</option>
        <option name="mapping.map.center">(17.98,4.57)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.seriesColors">[0x00FF00, 0xFF0000, 0xFFFF00, 0x000000 ]</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.tileOpacity">0.7</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
        <option name="mapping.type">choropleth</option>
      </map>
    </panel>
  </row>
</dashboard>

The seriesColors will reflect the SORTED values of the range field, so G R Y W for your colours reflect the ordering of the colours in that setting. Note if you do not do the 'sort range' it will change the colours.

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

See this example dashboard using your example data

<dashboard>
  <label>Test</label>
  <row>
    <panel>
      <map>
        <search>
          <query>| makeresults
| eval _raw="country,device,logon_duration
Brazil,XYZ01,21.05
United States,ABC01,16.99
Germany,FE-01,5.75
India,MUM01,10.00"
| multikv forceheader=1
| eval CountryName=country
| rangemap field=logon_duration green=0-10 yellow=11-20 red=21-99 default=white
| fields CountryName range
| sort range
| geom geo_countries featureIdField=CountryName
          </query>
          <earliest>0</earliest>
        </search>
        <option name="drilldown">all</option>
        <option name="height">600</option>
        <option name="mapping.choroplethLayer.colorBins">4</option>
        <option name="mapping.choroplethLayer.colorMode">auto</option>
        <option name="mapping.choroplethLayer.minimumColor">0x53a051</option>
        <option name="mapping.choroplethLayer.neutralPoint">50</option>
        <option name="mapping.choroplethLayer.shapeOpacity">0.85</option>
        <option name="mapping.map.center">(17.98,4.57)</option>
        <option name="mapping.map.zoom">2</option>
        <option name="mapping.seriesColors">[0x00FF00, 0xFF0000, 0xFFFF00, 0x000000 ]</option>
        <option name="mapping.tileLayer.maxZoom">19</option>
        <option name="mapping.tileLayer.tileOpacity">0.7</option>
        <option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>
        <option name="mapping.type">choropleth</option>
      </map>
    </panel>
  </row>
</dashboard>

The seriesColors will reflect the SORTED values of the range field, so G R Y W for your colours reflect the ordering of the colours in that setting. Note if you do not do the 'sort range' it will change the colours.

 

0 Karma

dgoamaral
Engager

That works! Thanks a lot! 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...