https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-show-me-iplocation-on-all-time-real-time/m-p/590180#M103426 <P>In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".</P><P>Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.</P><P>Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.</P><P>Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)</P><P>&nbsp;</P> Tue, 22 Mar 2022 10:02:54 GMT PickleRick 2022-03-22T10:02:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-show-me-iplocation-on-all-time-real-time/m-p/590169#M103424 <P>i want splunk to show me the geolocation from incoming traffic. as everyone knows syslog lines can vary a lot, it is not parsed at all besides the time and date. after downloading a days worth of syslog traffic and using the "extract fields" to highlight the IP address that needs to be used to find the location it was possible to see on the world map where the traffic came from. what i need is this exact feature but for real time data, i want to see this information from the syslog file in real time. so far it hasn't worked, and i dont know how to fix it.</P> <P>i use the same search on both the real-time syslog and downloaded syslog file however it only works with the downloaded syslog</P> <LI-CODE lang="markup">index=_* OR index=* sourcetype=syslog | iplocation clientip | geostats count by Country</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> Tue, 22 Mar 2022 09:20:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-show-me-iplocation-on-all-time-real-time/m-p/590169#M103424 splunkboob 2022-03-22T09:20:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-show-me-iplocation-on-all-time-real-time/m-p/590180#M103426 <P>In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".</P><P>Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.</P><P>Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.</P><P>Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)</P><P>&nbsp;</P> Tue, 22 Mar 2022 10:02:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-to-show-me-iplocation-on-all-time-real-time/m-p/590180#M103426 PickleRick 2022-03-22T10:02:54Z