I wrote this Splunk search that gives me the lat and lon for both the destination IP address and source IP address based on each IP that comes into our system. I would like to be able to take this data using the geostats commands and plot both on a map. The records pulled from the search need to be keep together. I have tried using the eval command and basically putting these fields together, but the records come out mixed and not kept together. My data set could be thousands upon thousands of records
Ex. IP comes in from Germany and hits my site in the USA. I want the map to show this and possibly color coordinate the record.
index="firewall" host=XXXXX | iplocation src_ip | rename lat as src_lat, lon as src_lon, City as src_City, Region as src_Region, Country as src_Country | lookup Public_IP_Map "Private IP" as dest_ip OUTPUT "Public IP" as public_ip | iplocation public_ip | rename lat as dest_lat, lon as dest_lon, City as dest_City, Region as dest_Region, Country as dest_Country | stats count by src_ip, src_lat, src_lon, src_City, src_Region, src_Country, dest_ip, dest_lon, dest_lat, public_ip, dest_City, dest_Region, dest_Country, dest_port | sort - count
... View more