Splunk Search

How to edit my choropleth map to show the value a field created through an eval?


I have created a choropleth map, but the values on the map shown is "avg_duration". I want to have the value instead be "one". I think the problem might be because the "one" field was created through an eval. Any help is much appreciated, thanks!

sourcetype=apache host="*ucd"| 
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready")| 
geoip tip| 
stats avg(duration) by tip_country_name | 
rename avg(duration) as avg_duration |
join [search sourcetype=apache host="*ucd" | 
transaction tip, sid startswith="ucd-web/start" endswith=(x="landingready") | 
geoip tip | 
stats avg(duration) as "total_avg" ] | 
eval one=total_avg-avg_duration  |
geom geo_countries featureIdField=tip_country_name 
0 Karma


Current answer:

The map can only handle two values - in this case, you want tip_country_name and your "one", which is a delta_duration.

Add this code immediately before the last line in your query

table  tip_country_name one |
rename one as delta_duration |

Prior answer:

This would have worked, but the stats part is unnecessary overhead.

Try inserting this as the next-to-the-last line and see if the geom is picking what to display automagically from the last stats command it could see...

stats first(one) as delta_duration by tip_country_name |

I've used your standard of putting the pipe at the end.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...