Splunk Search

Show IP address while using Geostats and iplocation


I created a map showing connections outside the US but when I hover over the markers it only shows the lon and lat. I would like to have it show the IP instead.

Is it also possible to have it display the statistics? That way I have a table showing these connections and then the map as well.

Currently, I have a map and a stats table that I put on the dashboard but I would like to have these combined if possible.

Here's my query to show the connections outside the US on a map.

index=syslog earliest=-6h NOT
| iplocation dest_ip|search NOT Country="United States"
|geostats count

Here's the same query that I have displayed as a statistics table-
index=syslog* earliest=-6h
| iplocation destip|search NOT Country="United States"
| Table dest
ip count City Country|rename dest_ip as "Destination IP" count as "Connections"
|Sort by Country

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.