Google Maps and Exchange App

[davidts]

I am using version 2.1.0 of the Exchange App with Splunk 5.0.2. It is working great, but there is one thing that I need help on configuring. I have downloaded and installed the Google Maps app, but I can not find any instructions on how to get it to work with the Exchange app.

[treinke]

While I am not familiar with the Exchange app, you need to find the field that contains IP addresses. You then can add the:

 | geoip IPFIELD

to your search to give you information on the ip address. IT will then give you some new fields.

IPFIELD_city,IPFIELD_region_name,IPFIELD_country_name, etc.

Or in this example, I use a reguluar expression to find a pattern for ip addresses. This is for IIS logs but could be used for any log. (you need to remove the space between < and clientip>):

eventtype=iislogs | rex "(?< clientip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search NOT (clientip="192.168.*.*" OR clientip="10.*.*.*")| geoip clientip