Dashboards & Visualizations

Help/Suggestions on creating a heat map/cholopleth map using XFF (x-forwarded-for) data from IIS logs

mariog2000
Explorer

I'm very new to Splunk and this seems pretty easy in Kibana but in Splunk I'm really having a hard time finding anyone that has done this yet. Initially I'd like to pull x-forwarded-for (XFF) data from my IIS logs. I was hoping I could somehow use the query below or something similar to pull the XFF IP's for the geo-location, and create one heat map for values showing how many connections are coming from that geo-location, and possible create another heat map that could use XFF IP's and the time_taken fields to show me where users with slow connections are popping.

Here's an example of a query to get me started which I can graph, but clearly just changing the graph type to "Cluster Map" or "Choropleth Map"

index=web host=J00Podyp* status=200 | stats values(time_taken) as time_taken by x_forwarded_for UserID | where time_taken > 2000

I've read through a lot of other suggestions but none seem to be using it the way I've discussed, and all have been way over my head so if anyone has any suggestion, please type slowly and provide steps as if you're explaining it to someone at the bar, as this may be where my problem brings me.

One last thing I guess, we do have ITSI and that's definitely an option but I'd rather use what's easiest assuming this is even possible. Thanks in advance for any thoughts or ideas...

Tags (1)
0 Karma

mariog2000
Explorer

Not sure if anyone has interest in this but if anyone is trying to setup something similar I've got a working model for some of this I can share. I'm still working through the details but can share what I've got so far if it can help anyone else. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...