Hi,
I want to make a world map dashboard with my logs from a mail server.
In the logs, I don't have IP's, but email addresses for sender and receiver. I want to see on a world map, for example, if the receiver address is toto@msn.de, then I should see a dot in Germany.
I find many things about IP geolocalization, but, as I say, I don't have IP's in my logs.
Any ideas?
Thanks
Max
The map tools rely on coordinates (latitude and longitude)
And the GeoIP tools rely on IPs, to convert them to coordinates. So except if you have addresses to convert to IP you will not be able to use GeoIP.
If you want to try to estimate the country based on the email (.de->germany, .com -> commores, .org -> oregon, etc...) as you see you will have to improvise for some domains.
You may create a lookup with the coordinates in GPS notation for each country capital and map the domain to it.
see http://www.latlong.net/countries.html
example of lookup table :
domain,country,lat,long
de,Deutschland,52.58219142652431,13.0517578125
then use the geostats command, and a map visualization
see http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Geostats
The map tools rely on coordinates (latitude and longitude)
And the GeoIP tools rely on IPs, to convert them to coordinates. So except if you have addresses to convert to IP you will not be able to use GeoIP.
If you want to try to estimate the country based on the email (.de->germany, .com -> commores, .org -> oregon, etc...) as you see you will have to improvise for some domains.
You may create a lookup with the coordinates in GPS notation for each country capital and map the domain to it.
see http://www.latlong.net/countries.html
example of lookup table :
domain,country,lat,long
de,Deutschland,52.58219142652431,13.0517578125
then use the geostats command, and a map visualization
see http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Geostats
Ok thanks, that works for me.
I followed your example for a lookup file, that I put in $SPLUNK_HOME/etc/system/lookups/
I put in transforms.conf file ($SPLUNK_HOME/etc/system/local/):
[geoloc]
filename = geoloc.csv
And finaly use the lookup and the geostats command in research.
Thanks again!