How to make a world map dashboard using logs from an email server with no IP addresses?

[emixam3]

Hi,

I want to make a world map dashboard with my logs from a mail server.
In the logs, I don't have IP's, but email addresses for sender and receiver. I want to see on a world map, for example, if the receiver address is toto@msn.de, then I should see a dot in Germany.
I find many things about IP geolocalization, but, as I say, I don't have IP's in my logs.
Any ideas?

Thanks

Max

[yannK · Accepted solution]

The map tools rely on coordinates (latitude and longitude)
And the GeoIP tools rely on IPs, to convert them to coordinates. So except if you have addresses to convert to IP you will not be able to use GeoIP.

If you want to try to estimate the country based on the email (.de->germany, .com -> commores, .org -> oregon, etc...) as you see you will have to improvise for some domains.
You may create a lookup with the coordinates in GPS notation for each country capital and map the domain to it.
see http://www.latlong.net/countries.html

example of lookup table :

domain,country,lat,long
de,Deutschland,52.58219142652431,13.0517578125 

then use the geostats command, and a map visualization
see http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Geostats

[emixam3]

Ok thanks, that works for me.
I followed your example for a lookup file, that I put in $SPLUNK_HOME/etc/system/lookups/
I put in transforms.conf file ($SPLUNK_HOME/etc/system/local/):
[geoloc]
filename = geoloc.csv

And finaly use the lookup and the geostats command in research.

Thanks again!