Know your data columns When you create a search to generate a choropleth map, the search will have a column of fields, usually states, countries, or regions. This column is usually equivalent to the setting primary[0], the first column of results. There should be at least one more column that relates a numeric value to each field in the first column (color for NULL values can also be configured). This is often, but not always, the second column in the search results, equivalent to the setting primary[1]. If the number values you want to use are in a different column, use the equivalent setting primary[n-1] where n equals the number of the column.   Documentation - https://docs.splunk.com/Documentation/Splunk/9.1.0/DashStudio/mapsChor As per this, I modified my query to the one below and it worked | fields+ country, count   ... View more