You can do all of that with the dashboard Link Switcher capabilities: For manual country switching - Create a form element with your countries - Setup a link switcher like the one below <form> <label>Test switcher</label> <fieldset submitButton="false"> <input type="radio" token="country"> <label>Country</label> <choice value="China">China</choice> <choice value="US">US</choice> <default>China</default> <change> <condition value="China"> <set token="showChina">true</set> <unset token="showUs"></unset> </condition> <condition value="US"> <unset token="showChina"></unset> <set token="showUs">true</set> </condition> </change> </input> </fieldset> <row> <panel> <title>Current Country</title> <map depends="$showUs$"> <title>$country$</title> <search> <query>lat lon | head 1000 | lookup geo_countries longitude AS lon, latitude AS lat | stats count by featureId | geom geo_countries</query> </search> <option name="mapping.map.center">(37.3,-81.65)</option> <option name="mapping.map.panning">true</option> <option name="mapping.map.scrollZoom">false</option> <option name="mapping.map.zoom">4</option> <option name="mapping.type">choropleth</option> <option name="drilldown">all</option> </map> <map depends="$showChina$"> <title>$country$</title> <search> <query>lat lon | head 1000 | lookup geo_countries longitude AS lon, latitude AS lat | stats count by featureId | geom geo_countries</query> <earliest></earliest> <latest></latest> </search> <option name="mapping.map.center">(32.32,103.62)</option> <option name="mapping.map.panning">1</option> <option name="mapping.map.scrollZoom">0</option> <option name="mapping.map.zoom">4</option> <option name="mapping.type">choropleth</option> </map> </panel> </row> </form> For automatic country switching Similar as above. Take a look at the "Null search swapper" example in the Splunk 6.x Dashboard Examples app to switch based on the search result ... View more

This is a bug in 6.3. and has been fixed in the recent 6.3.1 maintenance release (released on 11/4/15). Find more information and all bugfixes in the 6.3.1. Release Notes ... View more

6.3.1 was a maintenance release that includes recent bugfixes You can find all changes in the Release Notes for 6.3.1 ... View more

thanks for reporting that! I've uploaded a new version 1.0.4 that should fix the bug ... View more

Fieldformat is not recognized for Single Value in 6.3. You could set the "%" as an "After Label", and leave the number as is. ... View more

Unfortunately that's not possible at this moment with Splunk 6.3.. Let me offer you an alternative. Often when something like this happens it's because the one country's population (or user base or similar metric) is far larger than all other countries, outweighing all other countries when simply counting a metric. Take for example the use case of web analytics. The US with its ~320M will likely generate many more visitors than, say, Switzerland with its ~8M. One way around that is to normalize the metric. Three examples: You could do something like visits per capita (dividing visits by the population number for each country). You could compare a number for this week to the same metric last week. You could compare each number to a predefined goal or target That being said, it's absolutely possible that none of these will work for your use case, and you are indeed interested in absolute numbers. ... View more

It looks like there was a typo in the blog post. AFFGEOID needs to be in single quotes. So instead of /Placemark/ExtendedData/SchemaData/SimpleData[@name=AFFGEOID] it should be /Placemark/ExtendedData/SchemaData/SimpleData[@name='AFFGEOID'] You might have to remove the my_lookup folder from the lookups directory where your KMZ sits so that the index is properly rebuilt. ... View more

Hi thervig, Based on your description, it looks like there's an error with defining the lookup. You could check $SPLUNK_HOME/var/log/splunk/python.log and see if you see anything. One known issue is that feature ID names aren't escaped. That means the lookup might fail if you use either > or < in your names. ... View more

You could create an auxiliary field that you eventually hide from your results: ... | rex field=myfield "[A-Za-z]+\d{2}\(V(?<newfield>\d{2})\)" | convert num(newfield) | sort newfield | fields myfield rex will create a new field that only contains the numeric portion in parentheses. Since you probably want to display V8 before V70 you need to treat the new field as a number, ignoring the "V". Finally you can just ignore newfield for displaying purposes ... View more

There isn't any inherent limit to how many polygons you can load on the server side. The algorithms that do the point-in-polygon operation (the lookup) scale as the log of the number of vertices. When we return polygons to the browser, we use generalization and clipping to limit the amount of data returned while faithfully reproducing the shapes on the client. The biggest performance issue I can think of is the cost of building the lookup. This happens once - the first time you use the lookup. You might see a pause, as building the lookup scales with the number of vertices. However, once that is done, the lookup index is saved on disk. Note that right now there is a limit of shapes that you can show at a particular time (~2000) due to how many elements SVG can handle in the DOM. That means while you can do the lookup on millions of data points, you can't show more than ~2000 shapes with aggregated data at once. ... View more

You can customize the span width in like so: ... | timechart count span=1d ... View more