how to enrich the iplocation database with private IP addresses?

[wsw70]

Hello

I successfully use iplocation to map PUBLIC IP addresses on the built-in splunk> map.

I also would like to map PRIVATE ones (RFC 1918) via an IP <-> location table I would manually maintain. How can I do this?

[tgow]

I would try and use the geostats command to use a lookup file that has your private addresses. The lookup file would need to have the longitude and latitude information in it as well then you just tell the geostats command which field in the lookup file is the longitude/latitude fields. Here is an example search:

sourcetype=vendor_* | lookup price_lookup Code OUTPUTNEW product_name | table product_name VendorID | lookup vendors_lookup VendorID | geostats latfield=VendorLatitude longfield=VendorLongitude count by product_name

Here is a link to more information:

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Geostats