How to create a Geomap with the geostats command using source IP and destination IP?

[ryanprice22]

I wrote this Splunk search that gives me the lat and lon for both the destination IP address and source IP address based on each IP that comes into our system. I would like to be able to take this data using the geostats commands and plot both on a map. The records pulled from the search need to be keep together. I have tried using the eval command and basically putting these fields together, but the records come out mixed and not kept together. My data set could be thousands upon thousands of records

Ex. IP comes in from Germany and hits my site in the USA. I want the map to show this and possibly color coordinate the record.

index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | stats count by src_ip, src_lat, src_lon, src_City, src_Region, src_Country, dest_ip, dest_lon, dest_lat, public_ip, dest_City, dest_Region, dest_Country, dest_port | sort - count

[woodcock]

Try this to get you started:

 index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | geostats latfield=src_lat longfield=src_log count by dest_Country

You can only do a single "BY" in geostats and you must tell it what fields to use for lat/long.

[ryanprice22]

Yeah that doesn't allow me to do what I need. That plots the location of the src_ip address, but doesn't allow me to see a plot on the map of where it's going. It only show me on a hover over that it was destined for the USA.

[woodcock]

This gives you more detail but your pie chart will become silly if you pump too much data into it:

index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | eval destination = dest_Country . "/" . dest_Region . "/" . dest_City | geostats latfield=src_lat longfield=src_log count by destination