Check the README.txt file in the SPLUNK_HOME/etc/apps/maps directory. The map expects the _geo field to contain latitude and longitude in the format "27.664827,-81.515753", so you have the correct data, but you need to place it in the _geo field. Assuming that your field extractions are mapped like this: Field names: Name, _geo Data: Florida, "27.664827,-81.515753" Data: Texas, "31.968599,-99.901813" This search should map all events that contain a valid latitude/longitude in the _geo field: source="try2.csv" You may be merging several ideas here and getting confused. If you are using the csv file as a lookup, so you can pass a state name to the lookup and get back the lat/long, then your search should be referencing the lookup you created for the csv file. The "geoip" command that you're using is meant to pass an IP address and return a field named _geo that contains the latitude and longitude. Since you're not passing it an IP address you're not getting back the lat/long, and nothing appears on the map. ... View more