Splunk v6: GeoIP usage without pivot

[Simon]

Hi all

In Splunk v6, when using datamodels, I can add GeoIP information to ipv4 attributes.
Is it somehow possible, to use this GeoIP informations in a common search for later adding to a native map panel in a dashboard?

Thanks,
Simon

[ziegfried · Accepted solution]

You can use the iplocation search command to manually add location information based on IPv4 address in a search:

sourcetype=access_combined | iplocation clientip

In order to drive maps in dashboards with that information it's recommended to use the geostats command, which precomputes aggregated information for multiple zoom levels:

sourcetype=access_combined | iplocation clientip | geostats count

or

sourcetype=access_combined | iplocation clientip | geostats count by method

[Simon]

ChrisG: Thanks for pointing this out, but I was more asking for another IPv4 to location translation data base.

[ChrisG]

I think you can point to any tile server using the mapping.tileLayer.url attribute of the

[Simon]

Hey zigi, thanks. Fast and precise as always 🙂
Whichgeoip ddatabase is shipped with Splunk by default? Is there a way to replace it, eg. with a commercial version of maxmind?