Splunk 101: Choropleth Maps

Hey, and welcome to the video! My name is Elliot Riegner and I’m here with the Kinney Group to bring you a tutorial on Choropleth maps.

Splunk provides many visualizations to represent data. Some of which are suited for location, such as the choropleth map which we will be exploring today.

To get started, we’ll take a look at the data used throughout today’s demo.
This is a CSV file that I will be uploading to my Splunk instance. The first row in the file contains field names and the rest values.

Ingested in Splunk this is what the CSV of Employee Records looks like:

source="employee_data.csv" 
| eval Name=first_name + " " + last_name
| table Name ip_address state

Choropleth maps utilize KML or KMZ files, also known as ‘Keyhole Markup Language’ which use latitude and longitude coordinates to map out regions.

Let’s take a look at the KML file I will be using to create our choropleth map:

| inputlookup geo_us_states

Here we see a correlating field of state, and note the coordinates which define each state’s regions.
Let’s take a closer look at what the choropleth visualization is all about.
Notice that the count for each state is set to 0, causing all states to display the same highlighted color.

Now, let’s dive deeper into the employee CSV data to create our query

source="employee_data.csv" 
| stats count by state

Note that all states now have a count. We will use this data to populate our choropleth map.
In order to do so, we will use the ‘geom’ command to correlate the KML file’s featureId field which included states to the field name of state found within the employee CSV data.
As you can see, each state has a count of the number of employees residing within, as well as the coordinates used to map each state’s boundaries

source="employee_data.csv" 
| stats count by state
| geom geo_us_states featureIdField=state

While Splunk’s default formatting can be great for some datasets, let’s create custom values to use in our key and sort by on the map.
Using case statements, we are able to pass multiple argument and value pairs.

source="employee_data.csv" 
| stats count by state
| eval count = case(count<10, "Less than 10", count>10 AND count<30, "10-30", count>30 AND count<60, "30-60", count>60 AND count<100, "60-100", count>100, "Over 100")
| geom geo_us_states featureIdField=state

Finally, let’s take care of that null value and set it to something more user friendly

source="employee_data.csv" 
| stats count by state
| eval count = case(count<10, "Less than 10", count>10 AND count<30, "10-30", count>30 AND count<60, "30-60", count>60 AND count<100, "60-100", count>100, "Over 100")
| fillnull value="No Employees"
| geom geo_us_states featureIdField=state

As you can see, we now have a fully populated map visualizing the stats in which employees reside. Thank you so much for joining me in yet another Splunk tutorial

Meet our Expert Team

Be on the lookout for more Splunk tutorials! My team, the Tech Ops team, runs our Expertise on Demand service, which I’ll touch on a little more below. Our EOD team is responsible for knowing everything and anything around Splunk best practice… that’s why you’ll get access to a ton of video and written content from our team. EOD is designed to answer your team’s daily questions and breakthrough stubborn roadblocks.  Let us know below how we can help.

Start typing and press Enter to search