Splunk Search

How to add a clientip field to data sources for the iplocation command?

brian1_tate
Path Finder

I have a general question and I am more of a power user than admin level here (but I'm in the process of becoming one).

I went to use the iplocation command today from a data source (which we do not have - I suppose I need to define those too) but instead data that is simply tossed into indexes. When I examined firewall data, I noticed that there was no field clientip and therefore iplocation would not work. I know I can tag the src_ip field or something of that nature but what if I wanted to normalize this across any data index?

Furthermore, if I may make another inquiry - being there are no sourcetypes - just data in indexes, how would one go about defining those from the fields that are extracted?

Thank you all!

0 Karma

Jeremiah
Motivator

Any data in Splunk will have a host, source, and sourcetype field. So when you say you don't have sources or sourcetypes, you still must have some values in those fields? And maybe the issue is they are the same regardless of the actual source or type of data that isindexed?

0 Karma

sowings
Splunk Employee
Splunk Employee
  1. There are always sourcetypes, even if they're made up.
  2. The iplocation command accepts an argument for the field containing the IP information; it doesn't have to be called clientip.
  3. If you extract a field containing an IP address (by whatever name) you can still use iplocation against this field.

Let's say you have a field called firewall_src, just run:

< base search to find events > | iplocation firewall_src. Now you have additional enrichment on your events. You can then do something like geostats count to plot these on a map.

It's not likely to work against RFC1918 addresses, however.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...