(Optional) Use Trellis view to visualize multiple aggregate functions
Sometimes it's useful to visualize more than one value shaded over the same map region. If you want to invoke multiple aggregate functions to create your choropleth statistics table, use the Trellis view to compare them side-by-side.
- Locate and download USDM data
- Upload and configure your data
- Download a California counties shapefile
- Create a new geospatial lookup
- Generate a choropleth map
- When you're constructing the search that generates your choropleth statistics table, invoke multiple functions in the
statscommand. In this example, we compare average, maximum, and minimum drought scores:
source="us_drought_monitor.csv" State = CA date_year=2018 | rex field=County "(?<County>.+) County" | eval droughtscore=D1 + D2*2 + D3*3 + D4*4 | stats avg(droughtscore) as "Average 2018 Drought Score" max(droughtscore) as "Max 2018 Drought Score" min(droughtscore) as "Min 2018 Drought Score" by County
- Add the following to your search to use the
geomcommand in your SPL search to add the corresponding geospatial polygons to your table:
| geom ca_county_lookup featureIdField=County
- Run the search.
- In the Visualizations tab, notice that no shaded features appear because you have provided more than one aggregate value to map. Resolve this by selecting Trellis layout.
- Check the box labeled Use Trellis Layout.
- Under Split By, select Aggregations (3).
- Scroll and zoom to California in each map to compare the shading patterns of the three different values.
- Save the trellis map to your dashboard.
The Trellis map provides a visualization of three aggregate values side-by-side, to provide a fuller picture of drought conditions across California in 2018:
Generate a choropleth map
Use trellis layout to split visualizations
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 8.2.2104, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103