If your data has an IP address that identifies the source, then you can use the iplocation command. Assuming that the field name of the IP address is "source_ip", then this command will work to show you the country. a_search_that_identifies_potential_attacks | iplocation source_ip | table source_ip Country City Region lat lon By default, the command adds the additional fields to each event. Find out more in the docs at iplocation command You can filter the results by country or compute statistics with the returned fields, etc. I am sure that the results aren't perfect, but I think that they are based on the free version of the MAXMIND database. ... View more

You should not change it on the forwarder, but on the Splunk instance where the parsing takes place. This is usually the indexer. And props.conf can exist in many different places. And they all count, since they're merged together at runtime (when splunk restarts, or re-reads the configs). The one place where settings will always work is in /opt/splunk/etc/system/local. Open the props.conf there and make your adjustments. http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Propsconf This is a pretty short answer to what might develop into several follow-up questions. But please - do take the time to read some documentation. Especially on the topics of configuration file precedence, and the splunk data pipeline. http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Wheretofindtheconfigurationfiles http://docs.splunk.com/Documentation/Splunk/6.1.3/Deploy/Datapipeline /k ... View more