Is it possible to use a countrycode "US" for the geom command?

[HeinzWaescher]

Hi,

is it possible to use countrycodes like US, GB, CN for the geom command instead of ip or long/lat?

Thanks in advance
Heinz

[martin_mueller · Accepted solution]

Yes, you need one step in between though.
The default geo_countries geospatial lookup has a featureId based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default geo_attr_countries lookup like so:

| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

First line sets up dummy data, second line does the conversion, third line calls geom. Visualize using Choropleth for pretty colours.

[HeinzWaescher]

The example works fine for me, but my search does not for some reason.

| stats count by geoip_country_code
| rename geoip_country_code AS iso2
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

The statistics tab shows a correct country column and a filled geom column. But the Choropleth doesn't show the data.

[martin_mueller]

Is there any legend in the bottom right of the Choropleth map?
Any difference between the tables generated by my example and your tables?

[HeinzWaescher]

It seems, that there have been to many fields in the output of my search.

Using | fields+ count, country, geom before the geom command works fine now.
Thanks a lot!