Splunk Search

Splunk v6: GeoIP usage without pivot

Contributor

Hi all

In Splunk v6, when using datamodels, I can add GeoIP information to ipv4 attributes.
Is it somehow possible, to use this GeoIP informations in a common search for later adding to a native map panel in a dashboard?

Thanks,
Simon

Tags (3)
0 Karma
1 Solution

Influencer

You can use the iplocation search command to manually add location information based on IPv4 address in a search:

sourcetype=access_combined | iplocation clientip

In order to drive maps in dashboards with that information it's recommended to use the geostats command, which precomputes aggregated information for multiple zoom levels:

sourcetype=access_combined | iplocation clientip | geostats count

or

sourcetype=access_combined | iplocation clientip | geostats count by method

View solution in original post

Influencer

You can use the iplocation search command to manually add location information based on IPv4 address in a search:

sourcetype=access_combined | iplocation clientip

In order to drive maps in dashboards with that information it's recommended to use the geostats command, which precomputes aggregated information for multiple zoom levels:

sourcetype=access_combined | iplocation clientip | geostats count

or

sourcetype=access_combined | iplocation clientip | geostats count by method

View solution in original post

Contributor

ChrisG: Thanks for pointing this out, but I was more asking for another IPv4 to location translation data base.

0 Karma

Splunk Employee
Splunk Employee

I think you can point to any tile server using the mapping.tileLayer.url attribute of the element in simple XML; see http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#map

0 Karma

Contributor

Hey zigi, thanks. Fast and precise as always 🙂
Whichgeoip ddatabase is shipped with Splunk by default? Is there a way to replace it, eg. with a commercial version of maxmind?

0 Karma