Splunk Search

How to troubleshoot why my Choropleth map is not showing a certain Spanish Region using Splunk 6.4?

slr
Communicator

Hello.

I'm trying to plot values by regions in a choropleth map with a search like this:

|inputlookup some.csv | iplocation lang=es IP | search Region!="" Country="España" | stats count by Region | geom spain-regions featureIdField=Region

All regions are put in place...except Murcia. The geom field is empty for Murcia. If iplocation was wrong with the "typing" of Murcia (Who knows...) I created a CSV with two fields: Region and Values, and in Region, I wrote all the Spanish Regions... and again, Murcia didn't show up (yes, the rest of them show up in the map).

Could I list all the Spanish regions that geom accepts? Is this some kind of bug?

By the way, the deployment is an Ubuntu 14.04 64bits with Splunk Enterprise 6.4

Regards.

PD: If you think Murcia is misspelled, see this: https://en.wikipedia.org/wiki/Murcia

0 Karma
1 Solution

slr
Communicator

Ok, I found the problem.

When you use iplocation, you can obtain Continent, Country, Region and City... but in Spain exist an extra division: Province. Better if I type an example:

Europe (Continent) has 28 Countries. Spain (Country) has 17 Regions and 50 Provinces. Galicia is a Region with 4 Provinces: Pontevedra, Orense, Lugo, La Coruña. Any Province has a lot of cities and towns; for example, Pontevedra has Vigo, Pontevedra (capital), Sanxenxo, Moaña, Tui, etc...

Iplocation don't have a Province element, and at least for Spain, geom mix the Regions with the Provinces. In my case, in Spain I want the Province of Murcia (Murcia) but I get the Region (Región de Murcia), but if I want the real Regions (the 17) I can't get them with iplocation.

Maybe this is happening with other countries... but I hope this can be fix with a future release.

Regards.

Region list: https://en.wikipedia.org/wiki/Autonomous_communities_of_Spain
Province list: https://en.wikipedia.org/wiki/Provinces_of_Spain

View solution in original post

slr
Communicator

Ok, I found the problem.

When you use iplocation, you can obtain Continent, Country, Region and City... but in Spain exist an extra division: Province. Better if I type an example:

Europe (Continent) has 28 Countries. Spain (Country) has 17 Regions and 50 Provinces. Galicia is a Region with 4 Provinces: Pontevedra, Orense, Lugo, La Coruña. Any Province has a lot of cities and towns; for example, Pontevedra has Vigo, Pontevedra (capital), Sanxenxo, Moaña, Tui, etc...

Iplocation don't have a Province element, and at least for Spain, geom mix the Regions with the Provinces. In my case, in Spain I want the Province of Murcia (Murcia) but I get the Region (Región de Murcia), but if I want the real Regions (the 17) I can't get them with iplocation.

Maybe this is happening with other countries... but I hope this can be fix with a future release.

Regards.

Region list: https://en.wikipedia.org/wiki/Autonomous_communities_of_Spain
Province list: https://en.wikipedia.org/wiki/Provinces_of_Spain

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...