Splunk Search

How to plot choropleth data on maps? I have data from multi-cloud in respective index.

sh254087
Communicator

I am trying to understand how I can plot my multi-cloud subscription/service consumption data from different geo regions, on a clustered choropleth map visualization.

I have multi-cloud subscriptions with services provisioned and consumed from different regions. 

I want to know where to start with - from reading articles and documentation, I understand I should have longitude, latitude information in my data for each of the regions that I want to plot data for(at least, if not for all). None of my CSP data in respective indexes have this information. If I have to come up with a CSV, unsure  how I'll link them to get this to working. 

 

Anyone came across similar use-case?

 

Any help would be appreciated.

Labels (4)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you have a csv with the information, you can use lookup with a suitable key to retrieve the data relevant to each event

0 Karma

sh254087
Communicator

To keep it simpler, just trying with AWS cloud, to begin with.

Here's how my region_coordinates.csv which has the region, latitude and longitude and other fields looks like -

sh254087_0-1685360686013.jpeg

I have services and their respective cost consumption data which looks like this (on a trellis-pie visualization, just used this to convey better)- 

sh254087_1-1685360700438.jpeg

I am trying to get thispie visualization on a map something like this - (referring to 'sample dashboard example' app) - 

sh254087_2-1685360716830.jpeg

Tried geom and geostats command but did not get expected output.

 

0 Karma

sh254087
Communicator

I have the cloud consumption information indexed in real-time. I do not (or can not) have the consumption information in a csv. I want this map to showcase the cloud consumption data across different regions in real-time. I can come up with a csv having long and lat values for each cloud-regions. I'm unsure how to link these two to come up with the map visualization.

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...