Splunk Search

External IP location

Meena27
Explorer

Hi,

We have set to receive alerts like Brute force, Port Scanning from external IPs.

Is there anyway or query in Splunk to get the Country information about the External IP?

Tags (1)

MuS
Legend

Hi Meena27,

sure there is, you can use iplocation to get this kind of information and use geostats to show it on a google map inside Splunk.

cheers, MuS

Meena27
Explorer

Thanks MuS.

Please let me know how to install the Geo IP app and is Google Map is necessary for that?

0 Karma

jmeyers_splunk
Splunk Employee
Splunk Employee

you don't need an app for this. these commands are built into splunk. just have a search that includes an ip address, pipe that to iplocation and then pipe that to geostats. for example:

sourcetype=access_combined | iplocation clientip | geostats count

With that and 6.1+ you will have the option for "map" visualization. You can also supply anything to iplocation which is an IP and other aggregate operations to geostats. See the references for the search commands that @MuS already included above.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...