topic Re: Splunk v6: GeoIP usage without pivot in Splunk Search

Splunk v6: GeoIP usage without pivot

Simon — Fri, 18 Oct 2013 13:41:51 GMT

Hi all

In Splunk v6, when using datamodels, I can add GeoIP information to ipv4 attributes.
Is it somehow possible, to use this GeoIP informations in a common search for later adding to a native map panel in a dashboard?

Thanks,
Simon

Re: Splunk v6: GeoIP usage without pivot

ziegfried — Fri, 18 Oct 2013 22:18:45 GMT

You can use the iplocation search command to manually add location information based on IPv4 address in a search:

sourcetype=access_combined | iplocation clientip

In order to drive maps in dashboards with that information it's recommended to use the geostats command, which precomputes aggregated information for multiple zoom levels:

sourcetype=access_combined | iplocation clientip | geostats count

sourcetype=access_combined | iplocation clientip | geostats count by method

Re: Splunk v6: GeoIP usage without pivot

Simon — Fri, 18 Oct 2013 23:05:55 GMT

Hey zigi, thanks. Fast and precise as always 🙂
Whichgeoip ddatabase is shipped with Splunk by default? Is there a way to replace it, eg. with a commercial version of maxmind?

Re: Splunk v6: GeoIP usage without pivot

ChrisG — Sat, 19 Oct 2013 00:36:04 GMT

I think you can point to any tile server using the mapping.tileLayer.url attribute of the element in simple XML; see http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#map

Re: Splunk v6: GeoIP usage without pivot

Simon — Sat, 19 Oct 2013 08:16:14 GMT

ChrisG: Thanks for pointing this out, but I was more asking for another IPv4 to location translation data base.