Splunk Search

External IP location

Meena27
Explorer

Hi,

We have set to receive alerts like Brute force, Port Scanning from external IPs.

Is there anyway or query in Splunk to get the Country information about the External IP?

Tags (1)

MuS
SplunkTrust
SplunkTrust

Hi Meena27,

sure there is, you can use iplocation to get this kind of information and use geostats to show it on a google map inside Splunk.

cheers, MuS

Meena27
Explorer

Thanks MuS.

Please let me know how to install the Geo IP app and is Google Map is necessary for that?

0 Karma

jmeyers_splunk
Splunk Employee
Splunk Employee

you don't need an app for this. these commands are built into splunk. just have a search that includes an ip address, pipe that to iplocation and then pipe that to geostats. for example:

sourcetype=access_combined | iplocation clientip | geostats count

With that and 6.1+ you will have the option for "map" visualization. You can also supply anything to iplocation which is an IP and other aggregate operations to geostats. See the references for the search commands that @MuS already included above.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...