topic Re: combine search results with external data in Getting Data In

combine search results with external data

janfabo — Mon, 17 Jun 2013 05:41:42 GMT

Hello,

I have csv file with geo coordinates of my internal ip's. I dont know how to combine it with google maps. could you please provide me hints how to do that?

Thank you.

Re: combine search results with external data

chris — Mon, 17 Jun 2013 06:57:21 GMT

Hi,

Sigi Puchbauer helped me with this once. This is how he suggested to solve the issue:

You create an additional internal lookup that you can use to lookup internal ips

... | lookup geoip clientip | lookup internal_geoip ip as clientip OUTPUTNEW _geo

The internal_geoip Lookup is a CSV File with the following format:

ip,_geo
"10.1.1.0/24","47.11,8.15"
"10.1.2.0/24","77.11,-8.15"

In $SPLUNK_HOME/etc/system/default/transforms.conf the lookup has to be configured to make a CIDR match:

[internal_geoip]
filename = internal_geoip.csv
match_type = CIDR(ip)

You can then create a macro that does both lookup for you to make the searches easier

... | `geoip(clientip)`

Re: combine search results with external data

janfabo — Tue, 18 Jun 2013 15:26:39 GMT

Thank you Chris for your answer.

I have few transforms.conf on server and I don't know which one to use:

/opt/splunk/etc/apps/MAXMIND/default/transforms.conf
/opt/splunk/etc/apps/maps/default/transforms.conf
/opt/splunk/etc/apps/SplunkforSquid/default/transforms.conf
/opt/splunk/etc/system/default/transforms.conf

I want to create a dashboard, which will display the number of IP addresses if the ip address match CIDR in a csv file.

Re: combine search results with external data

chris — Tue, 18 Jun 2013 15:39:45 GMT

I'v just edited the answer. This file is a good place to start /opt/splunk/etc/system/local/transforms.conf. If you start developing your own apps it will be in /opt/splunk/etc/apps//default/transforms.conf

Re: combine search results with external data

janfabo — Tue, 18 Jun 2013 21:38:23 GMT

great, it's working. Thank you, chris.