Splunk Search

How to edit my choropleth map to show the value a field created through an eval?


I have created a choropleth map, but the values on the map shown is "avg_duration". I want to have the value instead be "one". I think the problem might be because the "one" field was created through an eval. Any help is much appreciated, thanks!

sourcetype=apache host="*ucd"| 
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready")| 
geoip tip| 
stats avg(duration) by tip_country_name | 
rename avg(duration) as avg_duration |
join [search sourcetype=apache host="*ucd" | 
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready") | 
geoip tip | 
stats avg(duration) as "total_avg" ] | 
eval one=total_avg-avg_duration  |
geom geo_countries featureIdField=tip_country_name 
0 Karma


Current answer:

The map can only handle two values - in this case, you want tip_country_name and your "one", which is a delta_duration.

Add this code immediately before the last line in your query

table  tip_country_name one |
rename one as delta_duration |

Prior answer:

This would have worked, but the stats part is unnecessary overhead.

Try inserting this as the next-to-the-last line and see if the geom is picking what to display automagically from the last stats command it could see...

stats first(one) as delta_duration by tip_country_name |

I've used your standard of putting the pipe at the end.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...