How can I go geoip lookup and plot data on splunk 6 native map?

[melonman]

Hi,

I have been using Google Map app mainly for lookup the locations of ipaddress.
With Splunk6, I can use native map without accessing internet, but googme map app is currently supported in up to Splunk 5, not splunk 6.

Is there any way to do geo ip lookup and get lat/lng info to plot the data on splunk map without using google map app?

Thank you

[_d_ · Accepted solution]

No, not interactively like you would with google maps. Yes, it sucks. In this release maps are only available as visualizations instead.

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/Visualizationreference#Maps

[melonman]

I did iplookup without internet connection and it worked. Looks like Splun has internal DB for ip location information already.

[akocak]

yes, it has mmdb table for these lookups. it supposed to be updated with each release.
if you want to get list dynamically, you would need to update limits.conf in server for iplookup.
you could point it to external web db as required. However, back it up before you do such a thing.

[melonman]

iplocation in Splunk 6 is using Maxmind DB internally?

[melonman]

so, I have to use iplocation command which actually have to talk to external iplocation service provider, correct?