topic Re: How can we create a report based on country geoip? in Reporting

How can we create a report based on country geoip?

seetharamanPr — Wed, 07 Dec 2016 07:51:55 GMT

Hi All,

I have to create a report where in if any IPs from the below countries hit our network, I should be able to see it.

• Iran
• Syria
• Yemen
• Romania
• Israel
• Russia
• China

Now I would like to know how to do this as I checked the geo ips of all these countries and there are too many. Is there an easier way of doing this? If so, kindly let me know the search string.

Regards
Pradeep

Re: How can we create a report based on country geoip?

jmallorquin — Wed, 07 Dec 2016 08:15:43 GMT

Hi,

Easy, use a lookup to list the countrys that you want to filter and then use the command iplocation with the field that you to identify the ip int he events

Hope i help you

Re: How can we create a report based on country geoip?

hardikJsheth — Wed, 07 Dec 2016 11:48:59 GMT

Use geostats command.

For example if I get latitude and logntitude in my events, it can be plotted on geo map using following query:

  index=main | geostats latfield=notifications{}.geoCoordinate.latitude longfield=notifications{}.geoCoordinate.longitude count by DeviceID