Format a choropleth SVG

Before you begin to format your SVG visualization, make sure you are familiar with creating and formatting SVG images, as outlined in Generate a choropleth map.

If you want a step by step tutorial on creating your own SVG maps and connecting them to your Splunk data, see the blog, "Painting with Data: Choropleth SVG" at https://www.splunk.com/en_us/blog/tips-and-tricks/painting-with-data-choropleth-svg.html

Almost all configuration and formatting must be done in the source editor.

Prerequisites

• You must upload your SVG locally; web-based images are not supported.

• In order to format your choropleth SVG, your image structure must have a path with a defined d attribute. The dattribute determines the shape of the SVG outline using pixel positioning. To read more about this configuration, see https://developer.mozilla.org/en-US/docs/Web/SVG/Tutorial/Paths.

You can also view an SVG's markup structure here: https://jakearchibald.github.io/svgomg/

Connect your SVG with the Splunk Enterprise app

Follow the steps in the following procedure to connect the path id attributes to your SPL query.

If you would like to use the campus SVG map, you can download, unzip, and add this campus.svg image to your dashboard: Campus.zip.

Steps

1. Define a path with a d attribute.
   For each section you want to define on your map, you must define a path with a d attribute. For example, if your SVG image is of a school campus, and there are 10 buildings, you must define a path with the d attribute for each building:


2. Assign each path a unique ID.
   The Splunk Dashboard App can only recognize the boundaries set by the d attribute if its path has a unique ID associated with it. For example in the image, the upper-middle building is called "RF-420", so you can use this as the building's unique ID to easily identify it. This path in your SVG will look similar to the following:
   
   If you want to view or change the path IDs for your SVG, or if someone else designed the image, you can use a text editor to access and edit this information.



Often, an SVG map will have extra meta-data that makes it very difficult to modify. You can use a free application like Inkscape to simplify the image data by saving the file type as an Optimized SVG.

3. Match your path ids to the first column of results returned by your search.
   There are many ways to do this. You can rename each field in the search using the eval command, you can create a lookup file to match the fields with the unique path IDs, or you can change the path IDs of your SVG image file to match the fields returned by your search. To see an example of how a lookup can be used to map path IDs to values, see: Example.


4. Ensure there is at least one column of numbers associated with each field in your search results.
   It is these number values that you will use to determine the fill color of each section. For example, if you run a search to measure network connection traffic (TCP/IP connections per hour) in each building on the school campus, your search would return a table similar to the following (this is not real data):


5. Set your color value ranges.
   This is the same process as creating regular choropleth color ranges. For more information on general choropleth map formatting see Format a choropleth map. In the encoding section of your dashboard definition, you set the featureId option to the first set of column results, your fields/path IDs. this is almost always represented by primary[0]. Use the value option to set the numerical values depending on which column they're in. If you have a table with only two columns, for example, this is primary[1]. Use the rangevalues type to then set your color ranges using hex codes or color names. For example:

   "encoding": {
   	"featureId": "primary[0]",
   	"fill": {
   		"field": "primary[1]",
   		"value": "primary[1]",
   		"format": {
   			"type": "rangevalue",
   			"ranges": [
   				{
   					"from": 50000,
   					"value": "#4beba8"
   				},
   				{
   					"from": 30000,
   					"to": 50000,
   					"value": "#f4df7a"
   				},
   				{
   					"from": 1000,
   					"to": 30000,
   					"value": "#fc9850"
   				},
   		              {
   		                        "to": 1000,
   					"value": "#ff7152"
   					} 
   

Example

The following example is the lookup table for the campus image. When used with the table visualization, it shows the columns that map the path id to the fields of the same name in the table and their associated numerical values.

| inputlookup choropleth_campus.csv

If the Visualization Picker is used to change this visualization from table to Choropleth SVG, the following image is created (you may need to refresh your browser).

Source options for choropleth SVG

Choropleth SVG options

The following options are available for editing choropleth SVG visualizations in the source editor:

Property	Type	Default	Description
SVG	string	N/A	KV store location of the SVG image.
backgroundColor	string	Light mode: "#FFFFFF". Dark mode: "#212527",	Specify, using a hex code, the background color behind the SVG map, title, and description. For example, "#0000FF"