How to get Splunk to show me iplocation on all time (real-time) syslogs without parsed fields

[splunkboob]

i want splunk to show me the geolocation from incoming traffic. as everyone knows syslog lines can vary a lot, it is not parsed at all besides the time and date. after downloading a days worth of syslog traffic and using the "extract fields" to highlight the IP address that needs to be used to find the location it was possible to see on the world map where the traffic came from. what i need is this exact feature but for real time data, i want to see this information from the syslog file in real time. so far it hasn't worked, and i dont know how to fix it.

i use the same search on both the real-time syslog and downloaded syslog file however it only works with the downloaded syslog

index=_* OR index=* sourcetype=syslog | iplocation clientip | geostats count by Country

[PickleRick · Accepted solution]

In order to use some field for manipulation, you must have this field extracted in one way or another. There's no way around it - it can be extracted in search time, it can be an indexed field, but if you want to use the field, you must have this field. So there's no such thing as "use a field without extracting it".

Secondly, as you noticed, "syslog" is a very broad term and does not usually specify a strict data format.

Thirdly, doing a real-time search across all indexes is a very bad idea performance-wise.

Fourthly, why would you expect data of sourcetype=syslog in internal indexes? (the _* ones)