Splunk Search

How to create a Geomap with the geostats command using source IP and destination IP?

ryanprice22
New Member

I wrote this Splunk search that gives me the lat and lon for both the destination IP address and source IP address based on each IP that comes into our system. I would like to be able to take this data using the geostats commands and plot both on a map. The records pulled from the search need to be keep together. I have tried using the eval command and basically putting these fields together, but the records come out mixed and not kept together. My data set could be thousands upon thousands of records

Ex. IP comes in from Germany and hits my site in the USA. I want the map to show this and possibly color coordinate the record.

index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | stats count by src_ip, src_lat, src_lon, src_City, src_Region, src_Country, dest_ip, dest_lon, dest_lat, public_ip, dest_City, dest_Region, dest_Country, dest_port | sort - count
0 Karma

woodcock
Esteemed Legend

Try this to get you started:

 index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | geostats latfield=src_lat longfield=src_log count by dest_Country

You can only do a single "BY" in geostats and you must tell it what fields to use for lat/long.

ryanprice22
New Member

Yeah that doesn't allow me to do what I need. That plots the location of the src_ip address, but doesn't allow me to see a plot on the map of where it's going. It only show me on a hover over that it was destined for the USA.

0 Karma

woodcock
Esteemed Legend

This gives you more detail but your pie chart will become silly if you pump too much data into it:

index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | eval destination = dest_Country . "/" . dest_Region . "/" . dest_City | geostats latfield=src_lat longfield=src_log count by destination
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...