topic Re: Query Help - Traffic stats by IP & Geolocation in Splunk Search

Query Help - Traffic stats by IP & Geolocation

jamesatwork703 — Thu, 09 Feb 2017 20:18:10 GMT

I'm reaching out to the Splunk community once again for some query help. I'm trying to find all the traffic going through my proxies, specifically the IPs and their geolocation. Does this seem feasible?

Thanks in advance!

Re: Query Help - Traffic stats by IP & Geolocation

starcher — Fri, 10 Feb 2017 00:27:42 GMT

You want to tack the iplocation command to the end the search that shows your traffic.

https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Iplocation

Re: Query Help - Traffic stats by IP & Geolocation

jamesatwork703 — Fri, 10 Feb 2017 13:16:16 GMT

That certainly helps, but I'm also looking for help with the query to find the information as well as tack on the geo-location options. Is there a specific search string that's used to find traffic going through a proxy?

Re: Query Help - Traffic stats by IP & Geolocation

starcher — Fri, 10 Feb 2017 15:12:48 GMT

That would be completely dependent on what your proxy log data looks like.