Creating a table in the google app (geo ip)

[Michael_Schyma1]

sourcetype=SidewinderFirewall NOT rule_name="Global__deny_all" srcburb=external dstport=3389 | lookup geo ip as srcip 

I am trying to create a TABLE using the google application to show a count by srcip and also show the source IP next to it. So in the table I want to have a count, srcip, and the geolocation of that src IP. I am just not 100% sure how to create this type of a table in google app. Everytime i use the 'table' or 'top' function in the application no results are returned.

Any suggestions?

[sdaniels]

I tried this in my system with access log data and it came up fine. Does this work for you. If you want to view the _geo field, you'll need to create a new field for it using eval before using table, stats commands. I went into Views->Sample Search and pasted in my search.

sourcetype=access_combined | lookup geo ip as clientip | eval myGeo=_geo | stats count by myGeo,clientip

[sdaniels]

Not sure what you mean by geo results tab. If you go to Views->Sample Search then paste in your results. you don't see anything? What about without everything after the lookup

[Michael_Schyma1]

When I change it to this:

sourcetype=SidewinderFirewall NOT rule_name="Global__deny_all" srcburb=external dstport=3389 | lookup geo ip as srcip | eval myGeo=_geo | stats count by myGeo,srcip

or when i use your search, i am still not getting any information in the geo results tab which i am guessing is the table, but when i go to events i do see logs coming through.

[Michael_Schyma1]

Thank you so much, Ill give it a shot and see if i can get it to work

[sdaniels]

You see the eval statement I have. In order to display that lat/long detail in a table you can't reference _geo, you need to create it as a new field using eval.

[Michael_Schyma1]

I am not sure what you mean by save the _geo field first. Could you explain that for me?