Splunk Google map like kaspersky map

[pmloikju]

Hi,

I project to realize a map of all attack on fortinet firewall like kaspersky cyber attack map.

I receive log by Syslog on firewall and have source and destination ip inside. I create a pivot to convert ip to longitude and latitude.

On Google maps app, i use this search

| pivot localisation rsique values(dstip_lat) values(dstip_lon)| geonormalize

I have this result in event tab with correct geo coordinates (i mask data) but i have no point on map.

Any idea ?

Thanks

[woodcock · Accepted solution]

The geoip app is no longer necessary because the feature is now built into Splunk via the iplocation command so try this on the search bar (not in a dashboard):

... | iplocation YourIPAddressFieldName

Then click on the Visualization tab, click on the leftmost menu/control (just under the word "Events") and select Map. You no longer need Google at all.

[pmloikju]

Thanks !

It's look great but i have no location data.

Is it need to configure a database for iplocation ?

[woodcock]

You cannot pass a multivalued field, try it like this:

| pivot localisation risque values(dstip) | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip

[pmloikju]

| pivot localisation rsique values(dstip)  | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip | geostats  count

Nice ! I got blue dot to each location on map with search bar but not in dashboard.

Now i will customize the map, with this i think:
http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/CustomChartingConfig-Overview

[woodcock]

Exactly, you should be able to save your search as a dashboard/panel using the "Save As" link.

[ChrisG]

For the map visualization, I think it's geostats, not iplocation?

• http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Visualizationreference#Maps
• http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Geostats
• http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/PanelreferenceforSimplifiedXML#map

[woodcock]

I got a populated world map doing it exactly the way that I described.

[ChrisG]

Okay, but... Iplocation does a lookup specifically for geographic information pertaining to IP addresses. If they have geographic data, then they appear on the map. If they don't, the event will have empty fields.

geostats is the general purpose search command to populate the map visualization.

Happy to upvote your tested answer here, because the OP is asking about IP addresses. But wanted to provide the broader context for future readers.

[woodcock]

I have used the exact use case that OP has which is how I know it will work. As far as needing the actual lat/long values, iplocation provides those, too (which is how the visualization works) as well as other location details.