Create a new geospatial lookup

Use your geographic feature collection file to create a new geospatial lookup in Splunk Web. For more information about geospatial lookups, see Define a geospatial lookup in Splunk Web in the Knowledge Manager Manual.

Prerequisites

• Locate and download USDM data
• Upload and configure your data
• Download a California counties shapefile

Upload the lookup file

Follow these steps to upload your geospatial feature collection file in Splunk Web:

1. Unzip the ca_counties.kmz.zip file you downloaded in the previous step.
2. Navigate to Settings > Lookups.
3. Under Lookup table files, click + Add new.
4. Ensure the Destination app is set to Search.
5. Under Upload a lookup file, click Choose File and select ca_counties.kmz.
6. Under Destination filename, enter ca_counties.kmz.

Configure the geospatial lookup

Follow these steps to configure your new geospatial lookup in Splunk Web:

1. Click Settings > Lookups and click + Add new under Lookup definitions.
2. Ensure the Destination app is set to Search.
3. Under Name, enter ca_county_lookup.
4. Under Type, select Geospatial.
5. Under Lookup file, select the ca_counties.kmz file you just uploaded.
6. Leave Feature Id Element blank, because this file includes the county name under the default Placemark/name in the .kml file. See The Feature Id Element field in the Knowledge Manager manual for more information about XML path expressions in geospatial lookups.
7. Click Save.
8. (Optional) Test your geospatial lookup file.
   1. In the Search & Reporting app search bar, run the following search:
      

      | inputlookup ca_county_lookup

      
      If no results appear, try expanding the time range of the search.
   2. Verify that the featureId field contains one row per county, and that the geom field contains polygons and their coordinates. Your search results table should look like the following example:

      count	featureCollection	featureId	geom
      0	ca_county_lookup	Alameda	{"type":"MultiPolygon","coordinates":[[[[-122.31109619140625, 37.8634033203125],[-122.31109619140625, 37.8634033203125]]]]}
      0	ca_county_lookup	Alpine	{"type":"MultiPolygon","coordinates":[[[[-119.93537902832031, 38.8084831237793],[-119.93537902832031, 38.8084831237793]]]]}
      0	ca_county_lookup	Butte	{"type":"MultiPolygon","coordinates":[[[[-121.63543701171875, 40.000885009765625],[-121.63543701171875, 40.000885009765625]]]]}
      0	ca_county_lookup	Calaveras	"type":"MultiPolygon","coordinates":[[[[-120.21088409423828, 38.500003814697266],[-120.21088409423828, 38.500003814697266]]]]}

   3. Select the Visualization tab and set the visualization type to Choropleth Map.
   4. Zoom to California by clicking the + button or double-clicking the map and verify that the county polygons are displaying properly.

Next step

Generate a choropleth map