topic External IP location in Splunk Search

External IP location

Meena27 — Mon, 07 Apr 2014 03:18:42 GMT

Hi,

We have set to receive alerts like Brute force, Port Scanning from external IPs.

Is there anyway or query in Splunk to get the Country information about the External IP?

Re: External IP location

MuS — Mon, 07 Apr 2014 05:51:31 GMT

Hi Meena27,

sure there is, you can use iplocation to get this kind of information and use geostats to show it on a google map inside Splunk.

cheers, MuS

Re: External IP location

Meena27 — Wed, 30 Jul 2014 09:21:29 GMT

Thanks MuS.

Please let me know how to install the Geo IP app and is Google Map is necessary for that?

Re: External IP location

jmeyers_splunk — Wed, 12 Nov 2014 00:47:36 GMT

you don't need an app for this. these commands are built into splunk. just have a search that includes an ip address, pipe that to iplocation and then pipe that to geostats. for example:

sourcetype=access_combined | iplocation clientip | geostats count

With that and 6.1+ you will have the option for "map" visualization. You can also supply anything to iplocation which is an IP and other aggregate operations to geostats. See the references for the search commands that @MuS already included above.