topic Re: How to change "(unknown location)" ? in Splunk Dev

How to change "(unknown location)" ?

roshan_f — Fri, 17 Feb 2017 06:43:10 GMT

Hi Guys
final numbers called: 00442........ (unknown location)
How will I change (unknown location) to United Kingdom ?

Regards

Re: How to change "(unknown location)" ?

martin_mueller — Fri, 17 Feb 2017 09:49:34 GMT

So... you're splunking phone data and are trying to look up country code to country?

Re: How to change "(unknown location)" ?

nickhills — Fri, 17 Feb 2017 11:28:12 GMT

I have written a load of scripts which do this.

However, if your only worried about UK only (or a very small set of international numbers) you can probably do some simple |eval location=if(prefix="0044","UK","Unknown") type stuff.

But if you want to catch any country code you are going to be better off with lookup tables, or some lookup scripts which do the heavy lifting.

Re: How to change "(unknown location)" ?

roshan_f — Fri, 17 Feb 2017 13:12:32 GMT

Thank you , Sound Good to me
Where is teh lookup tables ?
Regards

Re: How to change "(unknown location)" ?

roshan_f — Fri, 17 Feb 2017 13:23:21 GMT

Thank you Nick
Manged to find it
Appreciate you assisting and pointing me toward the correct direction

Re: How to change "(unknown location)" ?

nickhills — Fri, 17 Feb 2017 13:25:36 GMT

let me upload it somewhere

Re: How to change "(unknown location)" ?

roshan_f — Fri, 17 Feb 2017 13:38:04 GMT

Sorry i did the changes but do not see it reflected while i generated my reports
Do i need to Stop and Start any service

Regards

Re: How to change "(unknown location)" ?

nickhills — Fri, 17 Feb 2017 13:53:46 GMT

Download the global location lookup file from here:
https://github.com/nickhills81/telephonyToolbox/blob/master/lookups/global-loc.csv

From the UI, goto Lookups - Lookup table files
Add new, choose file. I suggest you keep the filename the same
-or copy the lookup file to yourApp/lookups (you may need to create that folder if you have no existing lookups)

From the UI, goto Lookups - Lookup definitions
Add a file-based lookup definition using global-loc.csv

You will now be able to perform lookups like so:

somesearch|lookup global-loc countryCode as yourcountryCode areaCode as yourareaCode OUTPUTNEW countryName,areaName,cCity,lat,lon,iso2|table yourcountryCode yourareaCode  countryName,areaName,cCity,lat,lon,iso2

Which should give you a table like so:

Re: How to change "(unknown location)" ?

nickhills — Fri, 17 Feb 2017 16:26:01 GMT

just a note on the cCity field...
This is a lookup file i have compiled over time. For some countries (UK,US and a few others) the coordinates are based on the area code. However in cases where i have not found a decent position information for the area (or its too small) the lat and long relates to the Capital City. Good for pub quiz trivia too!

Re: How to change "(unknown location)" ?

roshan_f — Mon, 20 Feb 2017 11:19:42 GMT

Thank you Nick
Totally appreciate your help

Re: How to change "(unknown location)" ?

nickhills — Mon, 20 Feb 2017 17:26:30 GMT

I noticed that there were a few obvious errors in the csv - apologies. I have corrected and reuploaded