Splunk Search

Is it possible to use a countrycode "US" for the geom command?

HeinzWaescher
Motivator

Hi,

is it possible to use countrycodes like US, GB, CN for the geom command instead of ip or long/lat?

Thanks in advance
Heinz

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Yes, you need one step in between though.
The default geo_countries geospatial lookup has a featureId based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default geo_attr_countries lookup like so:

| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

First line sets up dummy data, second line does the conversion, third line calls geom. Visualize using Choropleth for pretty colours.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Yes, you need one step in between though.
The default geo_countries geospatial lookup has a featureId based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default geo_attr_countries lookup like so:

| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

First line sets up dummy data, second line does the conversion, third line calls geom. Visualize using Choropleth for pretty colours.

HeinzWaescher
Motivator

The example works fine for me, but my search does not for some reason.

| stats count by geoip_country_code
| rename geoip_country_code AS iso2
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

The statistics tab shows a correct country column and a filled geom column. But the Choropleth doesn't show the data.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is there any legend in the bottom right of the Choropleth map?
Any difference between the tables generated by my example and your tables?

0 Karma

HeinzWaescher
Motivator

It seems, that there have been to many fields in the output of my search.

Using | fields+ count, country, geom before the geom command works fine now.
Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...