Splunk Search

Geoip - Limiting what is displayed

Armyeric
Path Finder

In my search on a display:

index="stuff" severity="high" OR severity="medium" | top attacker limit=20 | geoip attacker

...the resulting panel shows attacker, count, percent, attacker_country_code, attacker_country_name, attacker_city, attacker_region_name, attacker_latitude, attacker_longitude

How do I limit the geoip (from within the search) to show only country code and region name? I don't see anywhere in the documentation as to how I would do that.

Thanks for the help!

Tags (1)
0 Karma
1 Solution

wrangler2x
Motivator

When I use geoip in a search it is as a lookup which would precede the stats command (or top, or whatever). This lookup is of the form

| lookup geoip clientip as ip

This makes several fields available to be explicitly referenced in the search. If you don't specify them they won't show up. So I'd guess that your geoip is some form of field that expands. Try replacing what you show above with the lookup and add the fields you want.

Alternatively, you could add

| fields attacker count percent attacker_country_code attacker_region_name

to the end of your search to limit the fields that are output.

View solution in original post

wrangler2x
Motivator

When I use geoip in a search it is as a lookup which would precede the stats command (or top, or whatever). This lookup is of the form

| lookup geoip clientip as ip

This makes several fields available to be explicitly referenced in the search. If you don't specify them they won't show up. So I'd guess that your geoip is some form of field that expands. Try replacing what you show above with the lookup and add the fields you want.

Alternatively, you could add

| fields attacker count percent attacker_country_code attacker_region_name

to the end of your search to limit the fields that are output.

Armyeric
Path Finder

THANKS! It didn't even cross my mind that the command makes those fields referable. I had to go with the second option though since, in the geoip setup, we do not have lookup geoip enabled.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...