I know how to use the iplocation command to obtain geo ip information for a single field, for example:
sourcetype="IPS" | iplocation src_ip | table src_ip, City, Country
Is there a way to return geo ip information for 2 fields (in this case src-ip and dest-ip)? I tried this but it doesn't work:
sourcetype="IPS" | iplocation src_ip, dest_ip | table src_ip, City, Country, dest_ip, City, Country
How would I return geo ip info for both src-ip and dest-ip in a single search?
After some testing I figured it out, the search below works:
sourcetype="IPS" | iplocation src_ip | rename Country as CC1 | iplocation dest_ip | rename Country as CC2 | table src_ip CC1 dest_ip CC2
CC1 is the geo for the src-ip and CC2 is the geo for the dest-ip.
View solution in original post
You can also accomplish the same thing by doing this:
To access other data iplocation and that isn't part of the default values (ex: timezone) , you would add the allfields=true parameter to each iplocation command: