Google Maps Add-on for Splunk Enterprise: Why is geoip not plotting coordinates on the map?

[seriouscat]

Hi,

I've been trying to use the geoip command in the Google Maps add-on for Splunk Enterprise to geolocate ip addresses and I'm seeing events appear, but nothing is being plotted on the map and there are no georesults or matching events found.

I've been searching around on the internet for a couple of days, but have had no luck in finding an answer.

Here is my search:

sourcetype="******" "******"
| lookup dnslookup clienthost as ip OUTPUT clientip as temp 
| eval ip=if(match(ip,"\d+\.\d+\.\d+\.\d+"),ip,temp) 
| stats count by ip
| where count > 5
| sort - count
| geoip ip

Thanks for your help!

[martin_mueller]

Unless you actually are on Splunk 5.0, you should try using the 6.0+ built-in iplocation command: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/iplocation

Check out http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/Choroplethmaps for an overview of current-version mapping features.

[seriouscat]

I've tried that in conjunction with the geostats command. Unfortunately the geostats command messes up my tables. Is there an alternative to geostats which would plot the coordinates and not make any changes to the table?

[martin_mueller]

geostats is for mapping, not for displaying a table - if you want a table you can leave off geostats and just use iplocation on its own.