choropleth Map - how to use inputlookup geo_countries in splunk query

[dkgs]

Hello,

I need to highlight two countries in the choropleth map based on the count . 

index="index=1" | table atomName status|eval country= if(atomName == "APAC", "INDIA", "USA") |stats count by country |stats count by country | inputlookup geo_countries | geom geo_countries | where featureId=country

The above query is throwing error. Please do suggest how I can write the query

[rnowitzki · Accepted solution]

Hi @dkgs,

There are some issues with your SPL, check the Documentation on geom / choropleth map.

This should do it with your example:

index="index=1" 
| stats count by atomName 
| eval country= if(atomName == "APAC", "India", "United States") 
| stats sum(count) by country 
| geom geo_countries featureIdField=country

BR
Ralph

[dkgs]

@rnowitzki  Thank you this works. If I have multiple countries how should I give the if condition for the eval statement

| eval country= if(atomName == "APAC", "India", "United States") 

like I also need to add if atomName="EUR", it should be Netherlands , similarly multiple conditions for country

Thanks in advance

[rnowitzki]

Hi @dkgs,

You could combine several ifs, or better use case

| eval country= case(atomName="APAC", "India", atomName="EUR","Netherlands") 

So, it's a condition and the result for that condition. another condition, another  result. You can extend it with more conditions and results.

case has no "else" value, so you either have to give all possible values, or you put the "else" / "default" value in an eval before the case statement.

| eval country="United States"
| eval country=case(.....)

So it would stay "United States" if none of the case conditions match.

BR
Ralph