Community Blog
Get the latest updates on the Splunk Community, including member experiences, product education, events, and more!

How to create a Quick Highlighted map of States in Splunk

atoulme
Splunk Employee
Splunk Employee

Hello! I am an Engineering Manager on the Blockchain & DLT team and I wanted to share a project I recently created. I made a quick map of US States which would highlight my current team’s location.

Here is the end result:

atoulme_0-1654119338966.png

The challenge was to display multiple states at once. The documentation is helpful when it comes to highlighting just one element on the map:

 

 

 

| stats count | eval featureId="California" | eval count=10000 | geom geo_us_states allFeatures=true

 

 

 

To display multiple results, we will need multiple results.

So first off, let’s use makeresults to create results for our query.

makeresults has a fun example to create multiple events:

 

 

 

| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test 
| mvexpand test

 

 

 

We can use that with a list of US states instead:

 

 

 

| makeresults
| eval test="California Florida Colorado New Mexico"
| makemv delim=" " test 
| mvexpand test

 

 

 

We rename test to featureId and pass it to geom:

 

 

 

| makeresults
| eval featureId="California Florida Colorado New Mexico"
| makemv delim=" " featureId 
| mvexpand featureId
|eval count=10000
| geom geo_us_states allFeatures=true

 

 

 

It almost works, but New Mexico is not showing. That’s because we use a space delimiter. Let’s try to separate values with an underscore instead:

 

 

 

| makeresults
| eval featureId="California_Florida_Colorado_New Mexico"
| makemv delim="_" featureId
| mvexpand featureId
| eval count=10000
| geom geo_us_states allFeatures=true

 

 

 

Our map now shows values correctly.

Was this article helpful to you? Would you like to learn more about SPL techniques?

.conf22 is coming up ! Sign up now to join in Las Vegas or remotely. We will be traveling from all the states highlighted on the map to talk about blockchain, so make sure to read about and attend our talk, workshop and NFT activities!

— Antoine Toulme,  Senior Engineering Manager, Blockchain & DLT

Tags (3)
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...