google maps: show foreign origin

[genx]

Good afternoon.
I am new to Splunk and need assistance with the google maps app.

I am logging postfix logs, and using MAXMIND, can create a graph with the top foreign sources which connect to our servers.
This is useful when visualizing compromised accounts.

I use the following search:
host="smtp" source="/var/log/mail" | rex field=_raw "(?\d+.\d+.\d+.\d+)" | lookup geoip clientip as ip | search client_country="*" NOT client_country="South Africa"

I would like to show these results as the top region connecting but i cannot get the google maps app to reflect the results of the search, even though the graph works fine.

your assistance would be appreciated

[sdaniels · Accepted solution]

The field you are extracting seems to be 'ip' and that is what you'll need to pass to the geoip lookup.

...| lookup geoip ip | ... 

Also for your search after the lookup you do not need client_country="*" since it's already searching everything, just put your NOT expression.

| search NOT client_country="South Africa"

[genx]

Thank you very much.
worked perfectly.