Getting Data In

How to get Splunk to show me iplocation on all time (real-time) syslogs without parsed fields

splunkboob
Explorer

i want splunk to show me the geolocation from incoming traffic. as everyone knows syslog lines can vary a lot, it is not parsed at all besides the time and date. after downloading a days worth of syslog traffic and using the "extract fields" to highlight the IP address that needs to be used to find the location it was possible to see on the world map where the traffic came from. what i need is this exact feature but for real time data, i want to see this information from the syslog file in real time. so far it hasn't worked, and i dont know how to fix it.

i use the same search on both the real-time syslog and downloaded syslog file however it only works with the downloaded syslog

index=_* OR index=* sourcetype=syslog | iplocation clientip | geostats count by Country

 

 

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".

Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.

Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.

Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".

Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.

Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.

Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)

 

Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...