Hi All,
I have to create a report where in if any IPs from the below countries hit our network, I should be able to see it.
• Iran
• Syria
• Yemen
• Romania
• Israel
• Russia
• China
Now I would like to know how to do this as I checked the geo ips of all these countries and there are too many. Is there an easier way of doing this? If so, kindly let me know the search string.
Regards
Pradeep
Use geostats command.
For example if I get latitude and logntitude in my events, it can be plotted on geo map using following query:
index=main | geostats latfield=notifications{}.geoCoordinate.latitude longfield=notifications{}.geoCoordinate.longitude count by DeviceID
Hi,
Easy, use a lookup to list the countrys that you want to filter and then use the command iplocation with the field that you to identify the ip int he events
index sourcetype .... | iplocation yourfieldip | search [|inputlookup list_country.csv |table Country] | stats count by Country
Hope i help you