iplocation/mapping

[plumainwfs]

Is it possible to create a lookup such as below

ip,location
10.10.20.x,london
10.10.21.x,brazil
10.10.22.x,miami

And show it on the map? Then when clicking on the name will have results of all the failures for that location?

[sundareshr · Accepted solution]

The short answer is YES. Below are some links that will help you get it working

First, https://splunkbase.splunk.com/app/1603/ has some great examples on displaying data on a map. This also has some examples on how you can add drill-down to your dashboard.

The lookup command will help you map IP to location by setting lookup file. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

Tags is another way to map your servers to location http://docs.splunk.com/Documentation/Splunk/6.2.0/knowledge/Abouttagsandaliases