All Apps and Add-ons

SA-geodistance old location time

rtalcik
Path Finder

Hi all,

so i started using this APP here. - SA-geodistance and its nice, I like it. However I don't understand how it pulls the old location and how I get the time the of the old location it is pulling.

https://splunkbase.splunk.com/app/3232/ OR https://github.com/seunomosowon/SA-geodistance

0 Karma

seunomosowon
Communicator

The first time it sees an event within your search window with one set of lat/long coordinates, it uses that as the first event for that pair. It will have a relative distance of 0.

0 Karma

rtalcik
Path Finder

thanks for the post. question though. I understand its using the first event for that pair. but how can I get the time of that first event.

for example im trying to accomplish a vpn alert showing they logged into something over 200 miles away from the last 15 minutes.

If the first IP they're gathering is older than the amount of time it takes to travel over 200 miles than it could produce FPs

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...