The application log I am working with has ISO 3166 country code but no latitude and longitude details.
With that I am able to use a choropleth using the geom command easily using featureIdFIeld=countryname but I want to also visualize a cluster map also by country. Is there a way I can use geostats on this log without having latitude and longitude?
Hi @iyersudh geostats command uses lat and long to plot over the map (The events are clustered based on latitude and longitude fields in the events).
without lat/long, it is impossible to work on the maps(or, maybe some apps/addons need to be designed for this task).
everybody prefers the simple and easy route... ie, uploading/adding the lat/long lookup file to a splunk environment.
There is not the way to geostats command without lat & long.
https://gist.github.com/sindresorhus/1341699
you should make the lookup like above.