Working my way through the Splunk e-learning offerings, I came across a lab exercise where the resulting query was
"sourcetype=vendor_sales VendorID < 4000 | chart count by VendorStateProvince | geom geo_us_states featuredField=VendorStateProvince"
and I'm expected to use a Choropleth visualization to get a map of North America with the states and provinces shaded according to the search results.
What I get, though, is a world map with the legend in the lower right ("Alabama"..."Alberta"...etc.) but nothing plotted on the map at all.
I cannot find any tweaks in the "Format" dialogue which will help.
Am I doing something obviously (if not to me) incorrect, or is something broken on the e-learning backend?
Thanks for any info,
... View more