Splunk Search

How can I go geoip lookup and plot data on splunk 6 native map?

melonman
Motivator

Hi,

I have been using Google Map app mainly for lookup the locations of ipaddress.
With Splunk6, I can use native map without accessing internet, but googme map app is currently supported in up to Splunk 5, not splunk 6.

Is there any way to do geo ip lookup and get lat/lng info to plot the data on splunk map without using google map app?

Thank you

Tags (3)
1 Solution

_d_
Splunk Employee
Splunk Employee

No, not interactively like you would with google maps. Yes, it sucks. In this release maps are only available as visualizations instead.

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Visualizationreference#Maps

View solution in original post

_d_
Splunk Employee
Splunk Employee

No, not interactively like you would with google maps. Yes, it sucks. In this release maps are only available as visualizations instead.

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Visualizationreference#Maps

melonman
Motivator

I did iplookup without internet connection and it worked. Looks like Splun has internal DB for ip location information already.

akocak
Contributor

yes, it has mmdb table for these lookups. it supposed to be updated with each release.
if you want to get list dynamically, you would need to update limits.conf in server for iplookup.
you could point it to external web db as required. However, back it up before you do such a thing.

0 Karma

melonman
Motivator

iplocation in Splunk 6 is using Maxmind DB internally?

0 Karma

melonman
Motivator

so, I have to use iplocation command which actually have to talk to external iplocation service provider, correct?


map

sshd (Accepted OR Failed)
| rex "(?\d+.\d+.\d+.\d+)"
| rex "(?Accepted|Failed)"
| stats count by ip res
| iplocation ip
| geostats latfield=lat longfield=lon sum(count) as count by res

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...