topic Re: Is there a way to add a "country" field to logs based on their ip address in Splunk Search

Is there a way to add a "country" field to logs based on their ip address

anthonycopus — Wed, 09 Jul 2014 16:23:48 GMT

Hi,

Obviously ip addresses can be pushed onto a world map. However, I'd like to create reports Split by country specifically. This field is lacking in the logs but is it possible to add the field to the logs based on ip?

Anthony

Re: Is there a way to add a "country" field to logs based on their ip address

dshpritz — Wed, 09 Jul 2014 16:42:32 GMT

As of Splunk 6, you can use the iplocation command:

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Iplocation

This will provide the extra fields that you can use to get the stats you want. for example:

index=firewall | iplocation src_ip | stats count by City Country

Re: Is there a way to add a "country" field to logs based on their ip address

martin_mueller — Wed, 09 Jul 2014 16:42:37 GMT

Yeah, use the Splunk 6 iplocation command: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/iplocation
That adds a Country field amongst other things.