How can we create a report based on country geoip?

[seetharamanPr]

Hi All,

I have to create a report where in if any IPs from the below countries hit our network, I should be able to see it.

• Iran
• Syria
• Yemen
• Romania
• Israel
• Russia
• China

Now I would like to know how to do this as I checked the geo ips of all these countries and there are too many. Is there an easier way of doing this? If so, kindly let me know the search string.

Regards
Pradeep

[hardikJsheth]

Use geostats command.

For example if I get latitude and logntitude in my events, it can be plotted on geo map using following query:

  index=main | geostats latfield=notifications{}.geoCoordinate.latitude longfield=notifications{}.geoCoordinate.longitude count by DeviceID

[jmallorquin]

Hi,

Easy, use a lookup to list the countrys that you want to filter and then use the command iplocation with the field that you to identify the ip int he events

index sourcetype .... | iplocation yourfieldip | search [|inputlookup list_country.csv |table Country] | stats count by Country

Hope i help you