Splunk Search

choropleth Map - how to use inputlookup geo_countries in splunk query

dkgs
Communicator

Hello,

I need to highlight two countries in the choropleth map based on the count . 

index="index=1" | table atomName status|eval country= if(atomName == "APAC", "INDIA", "USA") |stats count by country |stats count by country | inputlookup geo_countries | geom geo_countries | where featureId=country

The above query is throwing error. Please do suggest how I can write the query

Labels (5)
0 Karma
1 Solution

rnowitzki
Builder

Hi @dkgs,

There are some issues with your SPL, check the Documentation on geom / choropleth map.

This should do it with your example:

index="index=1" 
| stats count by atomName 
| eval country= if(atomName == "APAC", "India", "United States") 
| stats sum(count) by country 
| geom geo_countries featureIdField=country


BR
Ralph


--
Karma and/or Solution tagging appreciated.

View solution in original post

rnowitzki
Builder

Hi @dkgs,

There are some issues with your SPL, check the Documentation on geom / choropleth map.

This should do it with your example:

index="index=1" 
| stats count by atomName 
| eval country= if(atomName == "APAC", "India", "United States") 
| stats sum(count) by country 
| geom geo_countries featureIdField=country


BR
Ralph


--
Karma and/or Solution tagging appreciated.

dkgs
Communicator

@rnowitzki  Thank you this works. If I have multiple countries how should I give the if condition for the eval statement

| eval country= if(atomName == "APAC", "India", "United States") 

like I also need to add if atomName="EUR", it should be Netherlands , similarly multiple conditions for country

Thanks in advance

0 Karma

rnowitzki
Builder

Hi @dkgs,

You could combine several ifs, or better use case

 

| eval country= case(atomName="APAC", "India", atomName="EUR","Netherlands") 

 


So, it's a condition and the result for that condition. another condition, another  result. You can extend it with more conditions and results.

case has no "else" value, so you either have to give all possible values, or you put the "else" / "default" value in an eval before the case statement.

 

| eval country="United States"
| eval country=case(.....)

 


So it would stay "United States" if none of the case conditions match.

BR
Ralph

--
Karma and/or Solution tagging appreciated.
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...