Can maps be plotted using IP address instead of coordinates?
How can I use the IP address to plot a location in a map?
As Krish3 mentioned, you're going to want to use iplocation
most likely, and after that, geostats
, e.g.:
... | iplocation clientip | geostats count by Country
Above answer is the preferred approach for 6.2 and below.
The new Splunk 6.3 introduced Choropleth Maps as a new visualization type. The new release ships with a geospatial lookup that contains all countries of the world as polygons to show on a map.
Find more information on Choropleth Maps in the Splunk Docs for 6.3.
I downvoted this post because did not give an example of how to create a choropleth map based on the original posters question
I downvoted this post because no attempt to answer the original posters question.
As Krish3 mentioned, you're going to want to use iplocation
most likely, and after that, geostats
, e.g.:
... | iplocation clientip | geostats count by Country
Yes you can try using iplocation
command.
your search query |iplocation IPaddress_fieldname
For more details go through the search reference manual here.