Splunk Search

How to edit my choropleth map to show the value a field created through an eval?


I have created a choropleth map, but the values on the map shown is "avg_duration". I want to have the value instead be "one". I think the problem might be because the "one" field was created through an eval. Any help is much appreciated, thanks!

sourcetype=apache host="*ucd"| 
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready")| 
geoip tip| 
stats avg(duration) by tip_country_name | 
rename avg(duration) as avg_duration |
join [search sourcetype=apache host="*ucd" | 
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready") | 
geoip tip | 
stats avg(duration) as "total_avg" ] | 
eval one=total_avg-avg_duration  |
geom geo_countries featureIdField=tip_country_name 
0 Karma


Current answer:

The map can only handle two values - in this case, you want tip_country_name and your "one", which is a delta_duration.

Add this code immediately before the last line in your query

table  tip_country_name one |
rename one as delta_duration |

Prior answer:

This would have worked, but the stats part is unnecessary overhead.

Try inserting this as the next-to-the-last line and see if the geom is picking what to display automagically from the last stats command it could see...

stats first(one) as delta_duration by tip_country_name |

I've used your standard of putting the pipe at the end.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...