Is there a way to add a "country" field to logs based on their ip address

[anthonycopus]

Hi,

Obviously ip addresses can be pushed onto a world map. However, I'd like to create reports Split by country specifically. This field is lacking in the logs but is it possible to add the field to the logs based on ip?

Anthony

[martin_mueller]

Yeah, use the Splunk 6 iplocation command: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/iplocation
That adds a Country field amongst other things.

[dshpritz]

As of Splunk 6, you can use the iplocation command:

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Iplocation

This will provide the extra fields that you can use to get the stats you want. for example:

index=firewall | iplocation src_ip | stats count by City Country