Location by Octet

[sgtwolf1]

I have a Linux Environment and SSH is a thing here. I need to show SSH log in with location. I got the map to work but know I need to figure out how to show the IP's based on two locations based on the first two octets of the IP address schema.  

Example:

Texas: 192.168.x.x

California: 172.16.x.x 

index=Exampe_index "ssh" sourcetype="Example_audit" "res"=success type=USER_LOGIN hostname=*| iplocation addr | geostats latfield=lat longfield=lon count

[richgalloway]

The iplocation command doesn't work with internal IP addresses (192.128.x.x, 10.x.x.x, etc.).  That's because many companies use the same IP address space so a lookup by IP alone is not meaningful.  Your company would have to create and install their own .mmdb file with the appropriate information.

[ITWhisperer]

Two or even three octets are insufficient to identify a location. What is it you are really trying to show?

[sgtwolf1]

Thank you everyone for commenting. I have pre-defined location already based on the first two octets of the IP address schema. I thought there would be a way to identify location in that manner. Example 

Log in attempt from user1 from 192.168.x.x means they are coming from Texas 

Log in attempt from user2 from 172.168.x.x mean they are coming from California. 

Rember this are examples and I totally understand their local IP and geo tagging might not be possible since there internal IP. In this example we know the first two octas indicated California or Texas.  The idea is to have a dashboard for Linux users that shows a map of Authentication user taking place based on IP address. There is only two IP address scheme we are dealing with and only two locations in this example each corresponding to the location in the example 192.168.x.x is Texas and 172.168.x.x is California. Hope this helps:) Something like the below image:

[richgalloway · Accepted solution]

Consider using a lookup table that maps the first two octets to a location.  If the lookup returns the same fields as the iplocation command then you could use the geostats command to display the data on a map.  You probably would need to create a lookup definition and use the Advanced settings to define CIDR match on the address field.  The lookup might look something like this

addr	City	Country	Region	lat	lon
192.168.0.0/16	foo	United States	Texas	xxx	yyy
172.168.0.0/16	bar	United States	California	aaa	bbb