Reporting

How to create a report that shows the number of events coming from a source IP address and include the iplocation data elements, City, State, Country?

jaybolser
New Member

I want to see on a daily basis, where traffic is coming from, something like below.

SourceIP Event Count City State Country
1.1.1.1. 24 Minneapolis MN USA
2.2.2.2 20 Anqing Anhui China

Tags (3)
0 Karma

Dallastek
Explorer

sourcetype=your source | iplocation SourceIP | stats count by SourceIP, City, Region, Country

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You should use the order from my answer, gives you the same result with way fewer invocations of iplocation.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

your base search | stats count as "Event Count" by SourceIP | iplocation SourceIP
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There is no field State, it's called Region.

That shouldn't stop it all from working though... check if you have the lat and lon fields after calling the iplocation command for your ip field.

0 Karma

jaybolser
New Member

I'm aware of the private address ranges and I'm excluding them from what I'm trying to do. It appears that I can't insert '|Table City, State, Country' with this sort of report.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Not all IP addresses have known location approximations, especially private ones. Make sure you're not suffering from that.

0 Karma

jaybolser
New Member

I tried that and I don't get any IPLocation data to add to the report.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...