Splunk Search

map visulization with lookup table

moayadalghamdi
Path Finder

Hello Splunkers !

 

i wanted to visualize data on map so i used this command and it worked:

index=myFirewall | stats count by src_ip | iplocation src_ip | geostats count by Country

 

but i want to show countries on map from a predefined list, so have a called "blacklisted.csv" that looks like this:

 blacklisted_countries
1country1
2country2
3country3
4country4
5country5

 

so i wrote a a search to combine the aforementioned search from the lookup table using this command:

 

index=myFirewall [ | inputlookup blacklisted.csv | search blacklisted_countries=srccountry] | stats count by src_ip | iplocation src_ip | geostats count by Country

 

but it didn't give me any results, please help me with it, i want a search the combines visualizing source countries with lookup tables.

 

 

 

Thanks

0 Karma
1 Solution

saravanan90
Contributor

This may help..

index=myFirewall [ | inputlookup blacklisted.csv| fields  blacklisted_countries | rename blacklisted_countries as srccountry] | stats count by src_ip | iplocation src_ip | geostats count by Country

View solution in original post

moayadalghamdi
Path Finder

exactly ! thanks splunker mate ^_^

0 Karma

nyc_jason
Splunk Employee
Splunk Employee

Hello,

Looks like you need to do the iplocation before hand, as the data doesnt yet contain the Country info until you do. This may not be the most efficient, but try this to get started, it worked for me:

index=myFirewall   |  iplocation clientip | lookup blacklisted.csv blacklisted_countries AS Country OUTPUT blacklisted_countries AS Country |  geostats count by Country

I created a lookup called blacklisted.csv with a column called blacklisted_countries which contain the list of countries. Ensure the names are initial caps. so Spain, not spain.

Also, not sure why you were doing the stats count by src_ip first, since the geostats is doing a count by country anyway, and that stats command will be removing all the fields aside from src_ip too.  So I just took it out.

 

0 Karma

saravanan90
Contributor

This may help..

index=myFirewall [ | inputlookup blacklisted.csv| fields  blacklisted_countries | rename blacklisted_countries as srccountry] | stats count by src_ip | iplocation src_ip | geostats count by Country

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...