Splunk Search

Why does "geom geo_us_states" search display a world map instead of North America map?

gl89
Engager

Working my way through the Splunk e-learning offerings, I came across a lab exercise where the resulting query was

"sourcetype=vendor_sales VendorID < 4000 | chart count by VendorStateProvince | geom geo_us_states featuredField=VendorStateProvince"

and I'm expected to use a Choropleth visualization to get a map of North America with the states and provinces shaded according to the search results.

What I get, though, is a world map with the legend in the lower right ("Alabama"..."Alberta"...etc.) but nothing plotted on the map at all.
I cannot find any tweaks in the "Format" dialogue which will help.

Am I doing something obviously (if not to me) incorrect, or is something broken on the e-learning backend?

Thanks for any info,

0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

The query above is logically correct but seems to have a typo; here's the corrected query:

sourcetype=vendor_sales VendorID < 4000 | chart count by VendorStateProvince | geom geo_us_states featureIdField=VendorStateProvince

uses featureIdField instead of featuredField

View solution in original post

mporath_splunk
Splunk Employee
Splunk Employee

The query above is logically correct but seems to have a typo; here's the corrected query:

sourcetype=vendor_sales VendorID < 4000 | chart count by VendorStateProvince | geom geo_us_states featureIdField=VendorStateProvince

uses featureIdField instead of featuredField

View solution in original post

gl89
Engager

That's exactly what I was missing. Thanks!

0 Karma

kapenta
New Member

index=Something srccountry="United States" | iplocation src | stats count by Region | geom geo_us_states featureIdField=Region : But it still shows the same world map and when I do the |inputlookup geo_us_states also it gives me world map .

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!