topic Re: How can I go geoip lookup and plot data on splunk 6 native map? in Splunk Search

How can I go geoip lookup and plot data on splunk 6 native map?

melonman — Thu, 17 Oct 2013 23:42:00 GMT

Hi,

I have been using Google Map app mainly for lookup the locations of ipaddress.
With Splunk6, I can use native map without accessing internet, but googme map app is currently supported in up to Splunk 5, not splunk 6.

Is there any way to do geo ip lookup and get lat/lng info to plot the data on splunk map without using google map app?

Thank you

Re: How can I go geoip lookup and plot data on splunk 6 native map?

_d_ — Fri, 18 Oct 2013 02:53:26 GMT

No, not interactively like you would with google maps. Yes, it sucks. In this release maps are only available as visualizations instead.

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Visualizationreference#Maps

Re: How can I go geoip lookup and plot data on splunk 6 native map?

melonman — Thu, 24 Oct 2013 06:51:43 GMT

so, I have to use iplocation command which actually have to talk to external iplocation service provider, correct?

Re: How can I go geoip lookup and plot data on splunk 6 native map?

melonman — Thu, 24 Oct 2013 07:53:42 GMT

iplocation in Splunk 6 is using Maxmind DB internally?

Re: How can I go geoip lookup and plot data on splunk 6 native map?

melonman — Mon, 28 Oct 2013 04:27:38 GMT

I did iplookup without internet connection and it worked. Looks like Splun has internal DB for ip location information already.

Re: How can I go geoip lookup and plot data on splunk 6 native map?

akocak — Tue, 30 May 2017 19:44:42 GMT

yes, it has mmdb table for these lookups. it supposed to be updated with each release.
if you want to get list dynamically, you would need to update limits.conf in server for iplookup.
you could point it to external web db as required. However, back it up before you do such a thing.