Splunk Search

Is there a way to add a "country" field to logs based on their ip address

anthonycopus
Path Finder

Hi,

Obviously ip addresses can be pushed onto a world map. However, I'd like to create reports Split by country specifically. This field is lacking in the logs but is it possible to add the field to the logs based on ip?

Anthony

martin_mueller
SplunkTrust
SplunkTrust

Yeah, use the Splunk 6 iplocation command: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/iplocation
That adds a Country field amongst other things.

dshpritz
SplunkTrust
SplunkTrust

As of Splunk 6, you can use the iplocation command:

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Iplocation

This will provide the extra fields that you can use to get the stats you want. for example:

index=firewall | iplocation src_ip | stats count by City Country
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...