How to revise my search in order to convert my cluster map into a choropleth map?

[dbcase]

Hi,

I have a query that supplies IP address and a status code and I have created a cluster map from the results

host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|rex "HTTP.\d.\d.\s+(?<status>\d+)"| iplocation src  |geostats count by status

I'd like to convert this to a choropleth map but so far no luck. As this is my first time trying this I'm kinda stuck.

[sundareshr · Accepted solution]

I think, for choropleth maps, you will need geo_* kmz files. Check your lookup definition, there should be a few. Pick the one that's appropriate for your data (countries, states etc). Then your query would look something like this (you'll have to tweak it)

host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex "HTTP.\d.\d.\s+(?<status>\d+)" | iplocation src  | lookup geo_countries latitude AS lat, longitude AS long | stats count BY featureIdField AS country | geom geo_countries featureIdField="country"

[dbcase]

Hi Sundareshr,

I think with your help I got it to work. Had to make a few changes on your query. It ended up looking like this

host="*beta*" source="*access_log*" index=main |rex "(?<src>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | rex "HTTP.\d.\d.\s+(?<status>\d+)" | iplocation src  | lookup geo_countries latitude AS lat, longitude AS lon |stats count BY featureId|geom geo_countries featureId="country"