Splunk Search

Splunk Google map like kaspersky map

pmloikju
Explorer

Hi,

I project to realize a map of all attack on fortinet firewall like kaspersky cyber attack map.

I receive log by Syslog on firewall and have source and destination ip inside. I create a pivot to convert ip to longitude and latitude.

On Google maps app, i use this search

| pivot localisation rsique values(dstip_lat) values(dstip_lon)| geonormalize

I have this result in event tab with correct geo coordinates (i mask data) but i have no point on map.
alt text

Any idea ?

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

The geoip app is no longer necessary because the feature is now built into Splunk via the iplocation command so try this on the search bar (not in a dashboard):

... | iplocation YourIPAddressFieldName

Then click on the Visualization tab, click on the leftmost menu/control (just under the word "Events") and select Map. You no longer need Google at all.

View solution in original post

woodcock
Esteemed Legend

The geoip app is no longer necessary because the feature is now built into Splunk via the iplocation command so try this on the search bar (not in a dashboard):

... | iplocation YourIPAddressFieldName

Then click on the Visualization tab, click on the leftmost menu/control (just under the word "Events") and select Map. You no longer need Google at all.

pmloikju
Explorer

Thanks !

It's look great but i have no location data.

Is it need to configure a database for iplocation ?

alt text

0 Karma

woodcock
Esteemed Legend

You cannot pass a multivalued field, try it like this:

| pivot localisation risque values(dstip) | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip

pmloikju
Explorer
| pivot localisation rsique values(dstip)  | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip | geostats  count

Nice ! I got blue dot to each location on map with search bar but not in dashboard.

Now i will customize the map, with this i think:
http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/CustomChartingConfig-Overview

0 Karma

woodcock
Esteemed Legend

Exactly, you should be able to save your search as a dashboard/panel using the "Save As" link.

0 Karma

woodcock
Esteemed Legend

I got a populated world map doing it exactly the way that I described.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Okay, but... Iplocation does a lookup specifically for geographic information pertaining to IP addresses. If they have geographic data, then they appear on the map. If they don't, the event will have empty fields.

geostats is the general purpose search command to populate the map visualization.

Happy to upvote your tested answer here, because the OP is asking about IP addresses. But wanted to provide the broader context for future readers.

woodcock
Esteemed Legend

I have used the exact use case that OP has which is how I know it will work. As far as needing the actual lat/long values, iplocation provides those, too (which is how the visualization works) as well as other location details.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...