The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.
This use case enables application developers and administrators to identify the location of users who access your applications in order optimize the demands placed on global network infrastructure.
This use case is from the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app. For more examples, see the Splunk Essentials for Infrastructure Troubleshooting and Monitoring on Splunkbase.
Load data
How to implement: Ingest web server access logs into Splunk Enterprise. Install the Splunk Add-On for Apache Web Server from Splunkbase.
Data check: This use case depends on web server access logs.
Get insights
Determine the geolocation of your users based on the client IP address from web server access logs using commands like iplocation and geostats. Visualize your data in pie charts, tables, and world maps.
Use the following search:
index=* sourcetype=access_combined
| iplocation clientip
| stats dc(clientip) AS unique_clientip BY Country
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, deploy the Add-ons to the search heads to access the knowledge objects necessary for simple searching. See About installing Splunk add-ons on Splunk Docs for assistance.
For more support, post a question to the Splunk Answers community.
The Splunk Product Best Practices team helped produce this response. Read more about use case examples Splunk® Platform Use Cases on Splunk Docs.
This use case enables application developers and administrators to identify the location of users who access your applications in order optimize the demands placed on global network infrastructure.
This use case is from the Splunk Essentials for Infrastructure Troubleshooting and Monitoring app. For more examples, see the Splunk Essentials for Infrastructure Troubleshooting and Monitoring on Splunkbase.
Load data
How to implement: Ingest web server access logs into Splunk Enterprise. Install the Splunk Add-On for Apache Web Server from Splunkbase.
Data check: This use case depends on web server access logs.
Get insights
Determine the geolocation of your users based on the client IP address from web server access logs using commands like iplocation and geostats. Visualize your data in pie charts, tables, and world maps.
Use the following search:
index=* sourcetype=access_combined
| iplocation clientip
| stats dc(clientip) AS unique_clientip BY Country
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, deploy the Add-ons to the search heads to access the knowledge objects necessary for simple searching. See About installing Splunk add-ons on Splunk Docs for assistance.
For more support, post a question to the Splunk Answers community.
