Splunk Search

Show IP address while using Geostats and iplocation


I created a map showing connections outside the US but when I hover over the markers it only shows the lon and lat. I would like to have it show the IP instead.

Is it also possible to have it display the statistics? That way I have a table showing these connections and then the map as well.

Currently, I have a map and a stats table that I put on the dashboard but I would like to have these combined if possible.

Here's my query to show the connections outside the US on a map.

index=syslog earliest=-6h NOT
| iplocation dest_ip|search NOT Country="United States"
|geostats count

Here's the same query that I have displayed as a statistics table-
index=syslog* earliest=-6h
| iplocation destip|search NOT Country="United States"
| Table dest
ip count City Country|rename dest_ip as "Destination IP" count as "Connections"
|Sort by Country

0 Karma