Splunk Search

what is the best addon / app to use with [iplocation] for a geographical visual dashboard?

packet_hunter
Contributor

I am looking to build a map of IP locations for remote vpn logins. Does anyone have any suggestions?

Tags (1)
1 Solution

lakromani
Builder

Not sure what you are looking for, but if you in the dashboard add this:

<option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>

You get a much more detailed map.

You search could be some like this:

your search | iplocation src_ip | eval City = if(isnull(City) OR City="" ,"Unknown",City), home=vpn_user."-".src_ip | geostats globallimit=0 count by home

View solution in original post

lakromani
Builder

Not sure what you are looking for, but if you in the dashboard add this:

<option name="mapping.tileLayer.url">http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png</option>

You get a much more detailed map.

You search could be some like this:

your search | iplocation src_ip | eval City = if(isnull(City) OR City="" ,"Unknown",City), home=vpn_user."-".src_ip | geostats globallimit=0 count by home

packet_hunter
Contributor

thank you i will try this

0 Karma

packet_hunter
Contributor

Hi Lakromani

Could you please give me a quick walk thru on where exactly I add the ?
I pasted it as the first line in the XML under edit > edit source, after .
Is that correct?
Thank you!

0 Karma

lakromani
Builder

Make your search work giving you the map.
Then save it as an Dashboard.
Open Dashboard
Edit Source
Paste the <option name="mapp.... to the option section.
Save.

0 Karma

packet_hunter
Contributor

Thx, I got it to work!

Is there a way to increase the zoom to a street level with this map?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...