Dashboards & Visualizations

Customize Legend on Choropleth Map

SplunkMaster22
Loves-to-Learn

I have the following command to create visualization on choropleth map which works but I get only the  categorical color  and volume as legend (without header),  how can I add more column full country name that I retrieve from geo_attr_countried to the legend and if possible with header of the columns?


index=main "registered successfully"
| rex "SFTP_OP_(?<country>(\w{2}))"
| stats count by country
| rename country AS iso2
| lookup geo_attr_countries iso2 OUTPUT country
| stats sum by country
| rename sum(count) AS Volume
| geom geo_countries featureIdField="country"

Basically, if possible, I am trying to get a legend something on the right bottom corner like the one below

Color CategoricalCountry NameVolume
ColorChina 124
ColorBrazil25
   
Labels (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...