All Apps and Add-ons

google maps: show foreign origin

genx
New Member

Good afternoon.
I am new to Splunk and need assistance with the google maps app.

I am logging postfix logs, and using MAXMIND, can create a graph with the top foreign sources which connect to our servers.
This is useful when visualizing compromised accounts.

I use the following search:
host="smtp" source="/var/log/mail" | rex field=_raw "(?\d+.\d+.\d+.\d+)" | lookup geoip clientip as ip | search client_country="*" NOT client_country="South Africa"

I would like to show these results as the top region connecting but i cannot get the google maps app to reflect the results of the search, even though the graph works fine.

your assistance would be appreciated

0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

The field you are extracting seems to be 'ip' and that is what you'll need to pass to the geoip lookup.

...| lookup geoip ip | ... 

Also for your search after the lookup you do not need client_country="*" since it's already searching everything, just put your NOT expression.

| search NOT client_country="South Africa"

View solution in original post

0 Karma

sdaniels
Splunk Employee
Splunk Employee

The field you are extracting seems to be 'ip' and that is what you'll need to pass to the geoip lookup.

...| lookup geoip ip | ... 

Also for your search after the lookup you do not need client_country="*" since it's already searching everything, just put your NOT expression.

| search NOT client_country="South Africa"
0 Karma

genx
New Member

Thank you very much.
worked perfectly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...