Getting Data In

How to get Splunk to show me iplocation on all time (real-time) syslogs without parsed fields

splunkboob
Explorer

i want splunk to show me the geolocation from incoming traffic. as everyone knows syslog lines can vary a lot, it is not parsed at all besides the time and date. after downloading a days worth of syslog traffic and using the "extract fields" to highlight the IP address that needs to be used to find the location it was possible to see on the world map where the traffic came from. what i need is this exact feature but for real time data, i want to see this information from the syslog file in real time. so far it hasn't worked, and i dont know how to fix it.

i use the same search on both the real-time syslog and downloaded syslog file however it only works with the downloaded syslog

index=_* OR index=* sourcetype=syslog | iplocation clientip | geostats count by Country

 

 

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".

Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.

Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.

Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".

Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.

Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.

Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)

 

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...