Splunk Search

How to plot choropleth data on maps? I have data from multi-cloud in respective index.

sh254087
Communicator

I am trying to understand how I can plot my multi-cloud subscription/service consumption data from different geo regions, on a clustered choropleth map visualization.

I have multi-cloud subscriptions with services provisioned and consumed from different regions. 

I want to know where to start with - from reading articles and documentation, I understand I should have longitude, latitude information in my data for each of the regions that I want to plot data for(at least, if not for all). None of my CSP data in respective indexes have this information. If I have to come up with a CSV, unsure  how I'll link them to get this to working. 

 

Anyone came across similar use-case?

 

Any help would be appreciated.

Labels (4)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you have a csv with the information, you can use lookup with a suitable key to retrieve the data relevant to each event

0 Karma

sh254087
Communicator

To keep it simpler, just trying with AWS cloud, to begin with.

Here's how my region_coordinates.csv which has the region, latitude and longitude and other fields looks like -

sh254087_0-1685360686013.jpeg

I have services and their respective cost consumption data which looks like this (on a trellis-pie visualization, just used this to convey better)- 

sh254087_1-1685360700438.jpeg

I am trying to get thispie visualization on a map something like this - (referring to 'sample dashboard example' app) - 

sh254087_2-1685360716830.jpeg

Tried geom and geostats command but did not get expected output.

 

0 Karma

sh254087
Communicator

I have the cloud consumption information indexed in real-time. I do not (or can not) have the consumption information in a csv. I want this map to showcase the cloud consumption data across different regions in real-time. I can come up with a csv having long and lat values for each cloud-regions. I'm unsure how to link these two to come up with the map visualization.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...