All Apps and Add-ons

Google Maps App Never Populates the Map with Results

keiche
Explorer

I have installed the latest versions of the Google Maps app and MAXMIND (amMaps works). Whenever I attempt to perform a search, the results will find IP addresses, but never places them on the map. I see there are other people who have the same concern as me, but there is no definitive answer online. I have even ran these queries as the administrator. How do I get the IP addresses to be geospatially mapped?

Here are some queries I've tried:

* | lookup geoip clientip | geonormalize

sourcetype=syslog | lookup geoip clientip | geonormalize

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval clientip=ip | lookup geoip clientip | geonormalize

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | lookup geoip clientip | geonormalize

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval clientip=ip | lookup geoip clientip | geonormalize

sourcetype=syslog | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval clientip=ip | lookup geoip clientip | geonormalize

All of these queries result in 0 different locations found, despite all of the events having IP addresses (and return results in the regular search mode).

1 Solution

ziegfried
Influencer

Did you try the geoip command? It ships with the Google Maps app.

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | geoip ip

Some of your searches should work, it seems something's wrong with the geonormalize command. I'll take a look at it.

View solution in original post

Akili
Path Finder

mee too. its not working

0 Karma

asleeis
Path Finder

I see similar issues. My fields are always extracting okay, but the map just seems to toggle back and forth with the "loading preview..." message. It's inconsistent, though. I had it working earlier. My boss never had it work. I've seen this off and on with mine. Sometimes restarting splunk helps. Sometimes not. Not really sure what's what.

0 Karma

the_wolverine
Champion

Ziegfried, just wanted to post that I tried out your app and have to say, AWESOME! Thanks for sharing.

0 Karma

ziegfried
Influencer

Did you try the geoip command? It ships with the Google Maps app.

* | rex "(?<ip>\d+\.\d+\.\d+\.\d+)" | geoip ip

Some of your searches should work, it seems something's wrong with the geonormalize command. I'll take a look at it.

sideview
SplunkTrust
SplunkTrust

Also seems to not work on windows for me. The geoip command adds no fields. Indeed on linux it seems fine.

keiche
Explorer

I switched over to the Linux version of splunk (away from Windows), and I got my search to work. Thanks ziegfried.

0 Karma

keiche
Explorer

I do not see these when I open up the "All 71 Fields" link

0 Karma

ziegfried
Influencer

Are you seeing the generated geo fields? They should be named like ip_countrycode, ip_latitude, etc.

0 Karma

keiche
Explorer

Hmmm, I just ran that query and it ended the same way - nothing on the map. The ip variable has over 100 unique IP addresses for the last 15min (and I filtered out the private IP spaces).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...