Splunk Search

Why does "geom geo_us_states" search display a world map instead of North America map?

Engager

Working my way through the Splunk e-learning offerings, I came across a lab exercise where the resulting query was

"sourcetype=vendor_sales VendorID < 4000 | chart count by VendorStateProvince | geom geo_us_states featuredField=VendorStateProvince"

and I'm expected to use a Choropleth visualization to get a map of North America with the states and provinces shaded according to the search results.

What I get, though, is a world map with the legend in the lower right ("Alabama"..."Alberta"...etc.) but nothing plotted on the map at all.
I cannot find any tweaks in the "Format" dialogue which will help.

Am I doing something obviously (if not to me) incorrect, or is something broken on the e-learning backend?

Thanks for any info,

0 Karma
1 Solution

Splunk Employee
Splunk Employee

The query above is logically correct but seems to have a typo; here's the corrected query:

sourcetype=vendor_sales VendorID < 4000 | chart count by VendorStateProvince | geom geo_us_states featureIdField=VendorStateProvince

uses featureIdField instead of featuredField

View solution in original post

Splunk Employee
Splunk Employee

The query above is logically correct but seems to have a typo; here's the corrected query:

sourcetype=vendor_sales VendorID < 4000 | chart count by VendorStateProvince | geom geo_us_states featureIdField=VendorStateProvince

uses featureIdField instead of featuredField

View solution in original post

Engager

That's exactly what I was missing. Thanks!

0 Karma

New Member

index=Something srccountry="United States" | iplocation src | stats count by Region | geom geo_us_states featureIdField=Region : But it still shows the same world map and when I do the |inputlookup geo_us_states also it gives me world map .

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!