Splunk Search

How to create a Geomap with the geostats command using source IP and destination IP?

ryanprice22
New Member

I wrote this Splunk search that gives me the lat and lon for both the destination IP address and source IP address based on each IP that comes into our system. I would like to be able to take this data using the geostats commands and plot both on a map. The records pulled from the search need to be keep together. I have tried using the eval command and basically putting these fields together, but the records come out mixed and not kept together. My data set could be thousands upon thousands of records

Ex. IP comes in from Germany and hits my site in the USA. I want the map to show this and possibly color coordinate the record.

index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | stats count by src_ip, src_lat, src_lon, src_City, src_Region, src_Country, dest_ip, dest_lon, dest_lat, public_ip, dest_City, dest_Region, dest_Country, dest_port | sort - count
0 Karma

woodcock
Esteemed Legend

Try this to get you started:

 index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | geostats latfield=src_lat longfield=src_log count by dest_Country

You can only do a single "BY" in geostats and you must tell it what fields to use for lat/long.

ryanprice22
New Member

Yeah that doesn't allow me to do what I need. That plots the location of the src_ip address, but doesn't allow me to see a plot on the map of where it's going. It only show me on a hover over that it was destined for the USA.

0 Karma

woodcock
Esteemed Legend

This gives you more detail but your pie chart will become silly if you pump too much data into it:

index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | eval destination = dest_Country . "/" . dest_Region . "/" . dest_City | geostats latfield=src_lat longfield=src_log count by destination
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...