Splunk Search
Highlighted

Why are Splunk custom polygons not showing up on a choropleth map?

Explorer

I was trying to do a Choropleth map with county I found in this blog article.

http://blogs.splunk.com/2015/10/01/use-custom-polygons-in-your-choropleth-maps/

It was really helpful and got me through most parts of it. I followed the instructions, but I can't for the life of me get the counties to show up in the visualizations. My search seems to work relatively fine and it shows the geom data, but it just doesn't show up on the map.

I used the us census site to get the KML file, https://www.census.gov/geo/maps-data/data/kml/kml_counties.html

0 Karma
Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Explorer

It looks like splunk isn't parsing out my kmz file correctly when i examine the geo definition for my results they where all the same. . . .

0 Karma
Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Splunk Employee
Splunk Employee

Hi @hdn6371,
I'm not sure of all the details of your situation, but are you using a KML file? Or did you convert it to a KMZ file?

Also, did you check that the lookup you created as part of using a custom KMZ file is generating a featureId?

If you could post your query, that might also help with troubleshooting.

Finally, if you haven't already had the chance, you might want to double-check the documentation about files, components, and choropleth queries here just to be sure everything is set up:
http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/Choroplethmaps#Components_for_building_geograp...

Thanks,
@frobinson_splunk

Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Explorer

@frobinson

index=dev "success"
| lookup geocounty longitude as lon, latitude as lat
| stats count by County
| geom geo
county

I followed the guide and added the KML file to a zip and change the extension to a kmz

0 Karma
Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Splunk Employee
Splunk Employee

Thanks for the details. Are the "lon" and "lat" fields in your query exactly as they appear in your event data?

I think there might be an issue between the lookup step and the "stats count by County" step in your query. Does the data already have location name fields? If so, you don't need to do the lookup part of the query. You can just aggregate by County, if this is the field name in the events data.

Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Explorer

Yes it is and the lon and lat are appearing.

Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Splunk Employee
Splunk Employee

Ok, that's good...

I think there might be an issue between the lookup step and the "stats count by County" step in your query. Does the data already have location name fields? If so, you don't need to do the lookup part of the query. You can just aggregate by County, if this is the field name in the events data.

0 Karma
Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Explorer

That's weird because I did that on the splunk goem of us states.

0 Karma
Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Splunk Employee
Splunk Employee

Can you try changing the stats part of your query to
|stats count by featureId
? Let me know if this changes anything in the visualization.

If this doesn't help, it might be useful to see a couple sample events from your data. Could you post a snippet?

Highlighted

Re: Why are Splunk custom polygons not showing up on a choropleth map?

Explorer

I got the visual to work but for some reason it only allowed me to key of of AFFGEOID even when I try to set what feature ID I want to use from the xml. However it seems that the KMZ file I converted to is somehow causing my bundle to blow up . . . which threw my entire cloud for a loop.

I basically had a cease and desist command on the task :(. Sadly I can't keep trying.