Splunk Search

How to plot data on the Splunk Map from lookup data using Country Name, Country Code, City Name but not IP?

DanielFordWA
Contributor

I have a system that requires authentication so each user has a unique identifier.

I have a lookup to enrich users that can return the "Location Country" or "Location Region" or ISO country codes.

I would like to plot data against these users actions on the Splunk map. I do not have access to the users IP address.

I've looked around for a while but have no idea how to do this, can anyone point me in the right direction?

Thanks,

Dan

Edit: for clarification... is there a way I can take the ISO country codes, or city names and look them up to produce a longitude and latitude, then use that in the maps?

It would seem like a trick has been missed if you cant convert ISO country codes this way.

Tags (3)
1 Solution

DanielFordWA
Contributor

Ok I found this.

https://opendata.socrata.com/dataset/Country-List-ISO-3166-Codes-Latitude-Longitude/mnkm-8ram

I hoped Splunk could do this without adding another lookup.

Cheers,

Dan

View solution in original post

DanielFordWA
Contributor

Ok I found this.

https://opendata.socrata.com/dataset/Country-List-ISO-3166-Codes-Latitude-Longitude/mnkm-8ram

I hoped Splunk could do this without adding another lookup.

Cheers,

Dan

marina_rovira
Contributor

Hello! How did you resolve this? I'm trying to visualize the data per cities in a map and I'm not achieving it 😞

Thank you!

0 Karma

strive
Influencer
0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...