topic Re: Splunk Google map like kaspersky map in Splunk Search

Splunk Google map like kaspersky map

pmloikju — Tue, 11 Aug 2015 14:11:48 GMT

Hi,

I project to realize a map of all attack on fortinet firewall like kaspersky cyber attack map.

I receive log by Syslog on firewall and have source and destination ip inside. I create a pivot to convert ip to longitude and latitude.

On Google maps app, i use this search

| pivot localisation rsique values(dstip_lat) values(dstip_lon)| geonormalize

I have this result in event tab with correct geo coordinates (i mask data) but i have no point on map.

Any idea ?

Thanks

Re: Splunk Google map like kaspersky map

woodcock — Tue, 11 Aug 2015 22:07:42 GMT

The geoip app is no longer necessary because the feature is now built into Splunk via the iplocation command so try this on the search bar (not in a dashboard):

... | iplocation YourIPAddressFieldName

Then click on the Visualization tab, click on the leftmost menu/control (just under the word "Events") and select Map. You no longer need Google at all.

Re: Splunk Google map like kaspersky map

ChrisG — Tue, 11 Aug 2015 23:07:37 GMT

For the map visualization, I think it's geostats, not iplocation?

Re: Splunk Google map like kaspersky map

woodcock — Tue, 11 Aug 2015 23:12:07 GMT

I got a populated world map doing it exactly the way that I described.

Re: Splunk Google map like kaspersky map

ChrisG — Tue, 11 Aug 2015 23:19:00 GMT

Okay, but... Iplocation does a lookup specifically for geographic information pertaining to IP addresses. If they have geographic data, then they appear on the map. If they don't, the event will have empty fields.

geostats is the general purpose search command to populate the map visualization.

Happy to upvote your tested answer here, because the OP is asking about IP addresses. But wanted to provide the broader context for future readers.

Re: Splunk Google map like kaspersky map

woodcock — Tue, 11 Aug 2015 23:29:13 GMT

I have used the exact use case that OP has which is how I know it will work. As far as needing the actual lat/long values, iplocation provides those, too (which is how the visualization works) as well as other location details.

Re: Splunk Google map like kaspersky map

pmloikju — Wed, 12 Aug 2015 08:42:32 GMT

Thanks !

It's look great but i have no location data.

Is it need to configure a database for iplocation ?

Re: Splunk Google map like kaspersky map

woodcock — Wed, 12 Aug 2015 13:07:26 GMT

You cannot pass a multivalued field, try it like this:

| pivot localisation risque values(dstip) | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip

Re: Splunk Google map like kaspersky map

pmloikju — Wed, 12 Aug 2015 15:20:56 GMT

| pivot localisation rsique values(dstip)  | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip | geostats  count

Nice ! I got blue dot to each location on map with search bar but not in dashboard.

Now i will customize the map, with this i think:
http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/CustomChartingConfig-Overview

Re: Splunk Google map like kaspersky map

woodcock — Wed, 12 Aug 2015 15:46:34 GMT

Exactly, you should be able to save your search as a dashboard/panel using the "Save As" link.