Device : Cisco ASA
How to Use INDIA Map in Dash Board Insted of World Map, And How to Use Custom IP Subnet Mapping to Location.
I Want to Use 18.104.22.168/24 Subnet to be mapped to Banglore, 22.214.171.124/24 Subnet to be mapped to Delhi
Source_type : cisco:asa
Index : asa_db
You could use eval to create a new ip field and then use that instead:
index=asa_db sourcetype=cisco:asa | eval ip=if(cidrmatch("126.96.36.199/24",src_ip),"188.8.131.52",match("184.108.40.206/24",src_ip),"220.127.116.11",src_ip) | iplocation ip | geostats count by city
This eval is using cidrmatch to match the two cidr you gave and changing them to a known TATA communications IP address, which will then map to Bangalore or Delhi. If the regex doesn't match then it leaves ip equal to the src_ip.
The search assumes the field you want to use for the eval I s called src_ip, but it might be different in your data.
To find public ips in each location I just googled "ip addresses Bangalore" and found a website that said which IPs were in Bangalore.