Splunk Search

How to troubleshoot why my Choropleth map is not showing a certain Spanish Region using Splunk 6.4?

slr
Communicator

Hello.

I'm trying to plot values by regions in a choropleth map with a search like this:

|inputlookup some.csv | iplocation lang=es IP | search Region!="" Country="España" | stats count by Region | geom spain-regions featureIdField=Region

All regions are put in place...except Murcia. The geom field is empty for Murcia. If iplocation was wrong with the "typing" of Murcia (Who knows...) I created a CSV with two fields: Region and Values, and in Region, I wrote all the Spanish Regions... and again, Murcia didn't show up (yes, the rest of them show up in the map).

Could I list all the Spanish regions that geom accepts? Is this some kind of bug?

By the way, the deployment is an Ubuntu 14.04 64bits with Splunk Enterprise 6.4

Regards.

PD: If you think Murcia is misspelled, see this: https://en.wikipedia.org/wiki/Murcia

0 Karma
1 Solution

slr
Communicator

Ok, I found the problem.

When you use iplocation, you can obtain Continent, Country, Region and City... but in Spain exist an extra division: Province. Better if I type an example:

Europe (Continent) has 28 Countries. Spain (Country) has 17 Regions and 50 Provinces. Galicia is a Region with 4 Provinces: Pontevedra, Orense, Lugo, La Coruña. Any Province has a lot of cities and towns; for example, Pontevedra has Vigo, Pontevedra (capital), Sanxenxo, Moaña, Tui, etc...

Iplocation don't have a Province element, and at least for Spain, geom mix the Regions with the Provinces. In my case, in Spain I want the Province of Murcia (Murcia) but I get the Region (Región de Murcia), but if I want the real Regions (the 17) I can't get them with iplocation.

Maybe this is happening with other countries... but I hope this can be fix with a future release.

Regards.

Region list: https://en.wikipedia.org/wiki/Autonomous_communities_of_Spain
Province list: https://en.wikipedia.org/wiki/Provinces_of_Spain

View solution in original post

slr
Communicator

Ok, I found the problem.

When you use iplocation, you can obtain Continent, Country, Region and City... but in Spain exist an extra division: Province. Better if I type an example:

Europe (Continent) has 28 Countries. Spain (Country) has 17 Regions and 50 Provinces. Galicia is a Region with 4 Provinces: Pontevedra, Orense, Lugo, La Coruña. Any Province has a lot of cities and towns; for example, Pontevedra has Vigo, Pontevedra (capital), Sanxenxo, Moaña, Tui, etc...

Iplocation don't have a Province element, and at least for Spain, geom mix the Regions with the Provinces. In my case, in Spain I want the Province of Murcia (Murcia) but I get the Region (Región de Murcia), but if I want the real Regions (the 17) I can't get them with iplocation.

Maybe this is happening with other countries... but I hope this can be fix with a future release.

Regards.

Region list: https://en.wikipedia.org/wiki/Autonomous_communities_of_Spain
Province list: https://en.wikipedia.org/wiki/Provinces_of_Spain

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...