sourcetype=SidewinderFirewall NOT rule_name="Global__deny_all" srcburb=external dstport=3389 | lookup geo ip as srcip
I am trying to create a TABLE using the google application to show a count by srcip and also show the source IP next to it. So in the table I want to have a count, srcip, and the geolocation of that src IP. I am just not 100% sure how to create this type of a table in google app. Everytime i use the 'table' or 'top' function in the application no results are returned.
I tried this in my system with access log data and it came up fine. Does this work for you. If you want to view the _geo field, you'll need to create a new field for it using eval before using table, stats commands. I went into Views->Sample Search and pasted in my search.
sourcetype=access_combined | lookup geo ip as clientip | eval myGeo=_geo | stats count by myGeo,clientip
When I change it to this:
sourcetype=SidewinderFirewall NOT rule_name="Global__deny_all" srcburb=external dstport=3389 | lookup geo ip as srcip | eval myGeo=_geo | stats count by myGeo,srcip
or when i use your search, i am still not getting any information in the geo results tab which i am guessing is the table, but when i go to events i do see logs coming through.