Source IP not plotting on cluster map

[dcraven02]

I'm trying to plot source IP Addresses (src_ip) from web events on a cluster map but it does not seem to work.

It only works for me when I use the destination IP Address (dest_ip)

index=barracuda user=test | iplocation dest_ip | geostats count by Country

When I change dest_ip to source_ip it doesnt return anything.

index=barracuda user=test | iplocation src_ip | geostats count by Country

[DalJeanis]

First, try this and see if you get anything

index=barracuda user=test | head 100 | stats by src_ip

If not, check the spelling and capitalization of your source IP field.

If so, try this...

index=barracuda user=test | head 1000| iplocation src_ip | geostats count by Country

If that works, it means you are running out of time and/or memory.

If that does not work, then your source ips may not be being resolved...

index=barracuda user=test | head 1000| iplocation src_ip | eval Country=coalesce(Country,"IDunno") | stats count by Country

See where that leads.

[mohanrajm]

Thank you for very simple step by step to troubleshoot this issue. It helped me 🙂