All Apps and Add-ons

Google Maps Add-on for Splunk Enterprise: Why is geoip not plotting coordinates on the map?

Explorer

Hi,

I've been trying to use the geoip command in the Google Maps add-on for Splunk Enterprise to geolocate ip addresses and I'm seeing events appear, but nothing is being plotted on the map and there are no georesults or matching events found.

I've been searching around on the internet for a couple of days, but have had no luck in finding an answer.

Here is my search:

sourcetype="******" "******"
| lookup dnslookup clienthost as ip OUTPUT clientip as temp 
| eval ip=if(match(ip,"\d+\.\d+\.\d+\.\d+"),ip,temp) 
| stats count by ip
| where count > 5
| sort - count
| geoip ip

Thanks for your help!

0 Karma

SplunkTrust
SplunkTrust

Unless you actually are on Splunk 5.0, you should try using the 6.0+ built-in iplocation command: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/iplocation

Check out http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/Choroplethmaps for an overview of current-version mapping features.

0 Karma

Explorer

I've tried that in conjunction with the geostats command. Unfortunately the geostats command messes up my tables. Is there an alternative to geostats which would plot the coordinates and not make any changes to the table?

0 Karma

SplunkTrust
SplunkTrust

geostats is for mapping, not for displaying a table - if you want a table you can leave off geostats and just use iplocation on its own.

0 Karma