Splunk Search

Is there a way to add a "country" field to logs based on their ip address

anthonycopus
Path Finder

Hi,

Obviously ip addresses can be pushed onto a world map. However, I'd like to create reports Split by country specifically. This field is lacking in the logs but is it possible to add the field to the logs based on ip?

Anthony

martin_mueller
SplunkTrust
SplunkTrust

Yeah, use the Splunk 6 iplocation command: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/iplocation
That adds a Country field amongst other things.

dshpritz
SplunkTrust
SplunkTrust

As of Splunk 6, you can use the iplocation command:

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Iplocation

This will provide the extra fields that you can use to get the stats you want. for example:

index=firewall | iplocation src_ip | stats count by City Country
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.