Google Maps App Never Populates the Map with Results

[keiche]

I have installed the latest versions of the Google Maps app and MAXMIND (amMaps works). Whenever I attempt to perform a search, the results will find IP addresses, but never places them on the map. I see there are other people who have the same concern as me, but there is no definitive answer online. I have even ran these queries as the administrator. How do I get the IP addresses to be geospatially mapped?

Here are some queries I've tried:

* | lookup geoip clientip | geonormalize

sourcetype=syslog | lookup geoip clientip | geonormalize

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval clientip=ip | lookup geoip clientip | geonormalize

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | lookup geoip clientip | geonormalize

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval clientip=ip | lookup geoip clientip | geonormalize

sourcetype=syslog | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval clientip=ip | lookup geoip clientip | geonormalize

All of these queries result in 0 different locations found, despite all of the events having IP addresses (and return results in the regular search mode).

[Akili]

mee too. its not working

[asleeis]

I see similar issues. My fields are always extracting okay, but the map just seems to toggle back and forth with the "loading preview..." message. It's inconsistent, though. I had it working earlier. My boss never had it work. I've seen this off and on with mine. Sometimes restarting splunk helps. Sometimes not. Not really sure what's what.

[the_wolverine]

Ziegfried, just wanted to post that I tried out your app and have to say, AWESOME! Thanks for sharing.

[ziegfried · Accepted solution]

Did you try the geoip command? It ships with the Google Maps app.

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | geoip ip

Some of your searches should work, it seems something's wrong with the geonormalize command. I'll take a look at it.

[sideview]

Also seems to not work on windows for me. The geoip command adds no fields. Indeed on linux it seems fine.

[keiche]

I switched over to the Linux version of splunk (away from Windows), and I got my search to work. Thanks ziegfried.

[keiche]

I do not see these when I open up the "All 71 Fields" link

[ziegfried]

Are you seeing the generated geo fields? They should be named like ip_countrycode, ip_latitude, etc.

[keiche]

Hmmm, I just ran that query and it ended the same way - nothing on the map. The ip variable has over 100 unique IP addresses for the last 15min (and I filtered out the private IP spaces).