Splunk Search

Is it possible to use a countrycode "US" for the geom command?

HeinzWaescher
Motivator

Hi,

is it possible to use countrycodes like US, GB, CN for the geom command instead of ip or long/lat?

Thanks in advance
Heinz

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Yes, you need one step in between though.
The default geo_countries geospatial lookup has a featureId based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default geo_attr_countries lookup like so:

| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

First line sets up dummy data, second line does the conversion, third line calls geom. Visualize using Choropleth for pretty colours.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Yes, you need one step in between though.
The default geo_countries geospatial lookup has a featureId based on the English name of the country, so you will have to map your ISO2(?) codes to that using the default geo_attr_countries lookup like so:

| stats count | eval iso2 = "US GB DE" | makemv iso2 | mvexpand iso2 | streamstats count
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

First line sets up dummy data, second line does the conversion, third line calls geom. Visualize using Choropleth for pretty colours.

HeinzWaescher
Motivator

The example works fine for me, but my search does not for some reason.

| stats count by geoip_country_code
| rename geoip_country_code AS iso2
| lookup geo_attr_countries iso2 OUTPUT country
| geom geo_countries featureIdField="country"

The statistics tab shows a correct country column and a filled geom column. But the Choropleth doesn't show the data.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is there any legend in the bottom right of the Choropleth map?
Any difference between the tables generated by my example and your tables?

0 Karma

HeinzWaescher
Motivator

It seems, that there have been to many fields in the output of my search.

Using | fields+ count, country, geom before the geom command works fine now.
Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...