Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- how we can identify peoples region in Splunk ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how we can identify peoples region in Splunk ?
Hello Team,
We have use case where we need to map/identify people's region in Splunk and create dashboard. Can we do something in Splunk?
we want to be able to write some performance dashboards and categorise people as internal/external and what region (UK/US/APAC/Other)
thanks
Nik
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Its mainly application logs indexed to Splunk and we are trying to create performance dashboard categorise people as internal/external and region (UK/US/APAC/Other).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you give some more information?
What Datasources do you have?
It is possible to make performance dashboards and filter to regions.
I did something like this. A Worldmap where the locations with a bad latency get marked.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Its mainly application logs indexed to Splunk and we are trying to create performance dashboard categorise people as internal/external and region (UK/US/APAC/Other).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, how can you seperate them? Are they all in an Active Directory?
Do they use diffrent subnets?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
all users are in Active directory
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok then you can use this data. Why don't you use the "c" attribute of the user? normally there should the country of the user be. and you could use the department attribute for the external users.
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...
Reduce and Transform Your Firewall Data with Splunk Data Management
