Splunk Search

what is the best addon / app to use with [iplocation] for a geographical visual dashboard?

packet_hunter
Contributor

I am looking to build a map of IP locations for remote vpn logins. Does anyone have any suggestions?

Tags (1)
1 Solution

lakromani
Builder

Not sure what you are looking for, but if you in the dashboard add this:

<option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>

You get a much more detailed map.

You search could be some like this:

your search | iplocation src_ip | eval City = if(isnull(City) OR City="" ,"Unknown",City), home=vpn_user."-".src_ip | geostats globallimit=0 count by home

View solution in original post

lakromani
Builder

Not sure what you are looking for, but if you in the dashboard add this:

<option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>

You get a much more detailed map.

You search could be some like this:

your search | iplocation src_ip | eval City = if(isnull(City) OR City="" ,"Unknown",City), home=vpn_user."-".src_ip | geostats globallimit=0 count by home

packet_hunter
Contributor

thank you i will try this

0 Karma

packet_hunter
Contributor

Hi Lakromani

Could you please give me a quick walk thru on where exactly I add the ?
I pasted it as the first line in the XML under edit > edit source, after .
Is that correct?
Thank you!

0 Karma

lakromani
Builder

Make your search work giving you the map.
Then save it as an Dashboard.
Open Dashboard
Edit Source
Paste the <option name="mapp.... to the option section.
Save.

0 Karma

packet_hunter
Contributor

Thx, I got it to work!

Is there a way to increase the zoom to a street level with this map?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...