Getting Data In

How to get Splunk to show me iplocation on all time (real-time) syslogs without parsed fields

splunkboob
Explorer

i want splunk to show me the geolocation from incoming traffic. as everyone knows syslog lines can vary a lot, it is not parsed at all besides the time and date. after downloading a days worth of syslog traffic and using the "extract fields" to highlight the IP address that needs to be used to find the location it was possible to see on the world map where the traffic came from. what i need is this exact feature but for real time data, i want to see this information from the syslog file in real time. so far it hasn't worked, and i dont know how to fix it.

i use the same search on both the real-time syslog and downloaded syslog file however it only works with the downloaded syslog

index=_* OR index=* sourcetype=syslog | iplocation clientip | geostats count by Country

 

 

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".

Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.

Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.

Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".

Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.

Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.

Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)

 

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...