topic Re: How to display multiple field ips using geostats in Splunk Search

How to display multiple field ips using geostats

rakeshyv0807 — Wed, 14 Mar 2018 21:28:50 GMT

Hi,

I have three fields which outputs Ip addresses. is there a way to display all these three field IP addresses on the map using geostats. Or is there any other way to populate those IP's on the map.

Thanks in advance

Re: How to display multiple field ips using geostats

niketn — Wed, 14 Mar 2018 21:53:24 GMT

@rakeshyv0807 can you add some sample data with three IP address fields and their values? Would these exist on same event and if yes will all three of them always be present on all the events?

Please make sure while posting the sample data you mock/anonymize the data.

Re: How to display multiple field ips using geostats

tiagofbmm — Wed, 14 Mar 2018 22:20:04 GMT

Use the append function to achieve that:

| makeresults 
| eval oneIP="192.123.123.12" 
| iplocation ADAS 
| append
 [| makeresults 
| eval otherIP="192.223.123.12" 
| iplocation otherIP]

Re: How to display multiple field ips using geostats

rakeshyv0807 — Thu, 15 Mar 2018 15:02:42 GMT

@niketnilay Yes, it's possible that all the three IP's would exist on same event but it is not necessary that all three will be present always in every event. Please refer to the sample data below
This sample data is which I am displaying in a table format right now:
Subject --> username
XFF -> IP address
TCIP -> IP address
XMSFCIP -> IP address

Table:

Subject--------------------------------- XFF------------------TCIP---------------------XMSFCIP
abc@abc.com---------------xx.xxx.xx.xxx----------No Value-------------xx.xxx.xx.xxx
qwe@wer.com-------------xx.xxx.xxx.xx--------xx.xxx.xx.xxx----------xx.xxx.xx.xxx
asd@fgh.com--------------xx.xxx.xx.xxx------------No Value---------------No Value
zxc@zxc.com------------------No Value------------xx.xxx.xxx.xx---------xx.xxx.xx.xxx

So is it possible to generate all the ip's in the map using geostats?