Splunk Search

choropleth Map - how to use inputlookup geo_countries in splunk query

dkgs
Communicator

Hello,

I need to highlight two countries in the choropleth map based on the count . 

index="index=1" | table atomName status|eval country= if(atomName == "APAC", "INDIA", "USA") |stats count by country |stats count by country | inputlookup geo_countries | geom geo_countries | where featureId=country

The above query is throwing error. Please do suggest how I can write the query

Labels (5)
0 Karma
1 Solution

rnowitzki
Builder

Hi @dkgs,

There are some issues with your SPL, check the Documentation on geom / choropleth map.

This should do it with your example:

index="index=1" 
| stats count by atomName 
| eval country= if(atomName == "APAC", "India", "United States") 
| stats sum(count) by country 
| geom geo_countries featureIdField=country


BR
Ralph


--
Karma and/or Solution tagging appreciated.

View solution in original post

rnowitzki
Builder

Hi @dkgs,

There are some issues with your SPL, check the Documentation on geom / choropleth map.

This should do it with your example:

index="index=1" 
| stats count by atomName 
| eval country= if(atomName == "APAC", "India", "United States") 
| stats sum(count) by country 
| geom geo_countries featureIdField=country


BR
Ralph


--
Karma and/or Solution tagging appreciated.

View solution in original post

dkgs
Communicator

@rnowitzki  Thank you this works. If I have multiple countries how should I give the if condition for the eval statement

| eval country= if(atomName == "APAC", "India", "United States") 

like I also need to add if atomName="EUR", it should be Netherlands , similarly multiple conditions for country

Thanks in advance

0 Karma

rnowitzki
Builder

Hi @dkgs,

You could combine several ifs, or better use case

 

| eval country= case(atomName="APAC", "India", atomName="EUR","Netherlands") 

 


So, it's a condition and the result for that condition. another condition, another  result. You can extend it with more conditions and results.

case has no "else" value, so you either have to give all possible values, or you put the "else" / "default" value in an eval before the case statement.

 

| eval country="United States"
| eval country=case(.....)

 


So it would stay "United States" if none of the case conditions match.

BR
Ralph

--
Karma and/or Solution tagging appreciated.
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.