Splunk Search

Is there a way to add a "country" field to logs based on their ip address

Path Finder

Hi,

Obviously ip addresses can be pushed onto a world map. However, I'd like to create reports Split by country specifically. This field is lacking in the logs but is it possible to add the field to the logs based on ip?

Anthony

SplunkTrust
SplunkTrust

Yeah, use the Splunk 6 iplocation command: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/iplocation
That adds a Country field amongst other things.

SplunkTrust
SplunkTrust

As of Splunk 6, you can use the iplocation command:

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Iplocation

This will provide the extra fields that you can use to get the stats you want. for example:

index=firewall | iplocation src_ip | stats count by City Country