Splunk Search

Splunk Google map like kaspersky map

Explorer

Hi,

I project to realize a map of all attack on fortinet firewall like kaspersky cyber attack map.

I receive log by Syslog on firewall and have source and destination ip inside. I create a pivot to convert ip to longitude and latitude.

On Google maps app, i use this search

| pivot localisation rsique values(dstip_lat) values(dstip_lon)| geonormalize

I have this result in event tab with correct geo coordinates (i mask data) but i have no point on map.
alt text

Any idea ?

Thanks

0 Karma
1 Solution

Esteemed Legend

The geoip app is no longer necessary because the feature is now built into Splunk via the iplocation command so try this on the search bar (not in a dashboard):

... | iplocation YourIPAddressFieldName

Then click on the Visualization tab, click on the leftmost menu/control (just under the word "Events") and select Map. You no longer need Google at all.

View solution in original post

Esteemed Legend

The geoip app is no longer necessary because the feature is now built into Splunk via the iplocation command so try this on the search bar (not in a dashboard):

... | iplocation YourIPAddressFieldName

Then click on the Visualization tab, click on the leftmost menu/control (just under the word "Events") and select Map. You no longer need Google at all.

View solution in original post

Explorer

Thanks !

It's look great but i have no location data.

Is it need to configure a database for iplocation ?

alt text

0 Karma

Esteemed Legend

You cannot pass a multivalued field, try it like this:

| pivot localisation risque values(dstip) | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip

Explorer
| pivot localisation rsique values(dstip)  | rename values(dstip) AS dstip | mvexpand dstip | iplocation dstip | geostats  count

Nice ! I got blue dot to each location on map with search bar but not in dashboard.

Now i will customize the map, with this i think:
http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/CustomChartingConfig-Overview

0 Karma

Esteemed Legend

Exactly, you should be able to save your search as a dashboard/panel using the "Save As" link.

0 Karma

Esteemed Legend

I got a populated world map doing it exactly the way that I described.

0 Karma

Splunk Employee
Splunk Employee

Okay, but... Iplocation does a lookup specifically for geographic information pertaining to IP addresses. If they have geographic data, then they appear on the map. If they don't, the event will have empty fields.

geostats is the general purpose search command to populate the map visualization.

Happy to upvote your tested answer here, because the OP is asking about IP addresses. But wanted to provide the broader context for future readers.

Esteemed Legend

I have used the exact use case that OP has which is how I know it will work. As far as needing the actual lat/long values, iplocation provides those, too (which is how the visualization works) as well as other location details.

0 Karma