How to troubleshoot why my Choropleth map is not showing a certain Spanish Region using Splunk 6.4?

[slr]

Hello.

I'm trying to plot values by regions in a choropleth map with a search like this:

|inputlookup some.csv | iplocation lang=es IP | search Region!="" Country="España" | stats count by Region | geom spain-regions featureIdField=Region

All regions are put in place...except Murcia. The geom field is empty for Murcia. If iplocation was wrong with the "typing" of Murcia (Who knows...) I created a CSV with two fields: Region and Values, and in Region, I wrote all the Spanish Regions... and again, Murcia didn't show up (yes, the rest of them show up in the map).

Could I list all the Spanish regions that geom accepts? Is this some kind of bug?

By the way, the deployment is an Ubuntu 14.04 64bits with Splunk Enterprise 6.4

Regards.

PD: If you think Murcia is misspelled, see this: https://en.wikipedia.org/wiki/Murcia

[slr · Accepted solution]

Ok, I found the problem.

When you use iplocation, you can obtain Continent, Country, Region and City... but in Spain exist an extra division: Province. Better if I type an example:

Europe (Continent) has 28 Countries. Spain (Country) has 17 Regions and 50 Provinces. Galicia is a Region with 4 Provinces: Pontevedra, Orense, Lugo, La Coruña. Any Province has a lot of cities and towns; for example, Pontevedra has Vigo, Pontevedra (capital), Sanxenxo, Moaña, Tui, etc...

Iplocation don't have a Province element, and at least for Spain, geom mix the Regions with the Provinces. In my case, in Spain I want the Province of Murcia (Murcia) but I get the Region (Región de Murcia), but if I want the real Regions (the 17) I can't get them with iplocation.

Maybe this is happening with other countries... but I hope this can be fix with a future release.

Regards.

Region list: https://en.wikipedia.org/wiki/Autonomous_communities_of_Spain
Province list: https://en.wikipedia.org/wiki/Provinces_of_Spain