Splunk Search

Search only spesific country

New Member

Hi I'm new in splunk.I have a firewall that send the log to splunk , and one of the information provide in the firewall log is country. And i want to search in splunk and came out the result for only all eastern europe country or all africa country without having to list one by one all the country, is it possible to do that?

Tags (1)
0 Karma


You will have to create a lookup table that has the mapping between country and continent/sub continent. You can then create a automatic lookup to add continent info to your events and use that to search.



You can create/maintain tags


0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...