Splunk Search

Using logs with IP addresses, how can I develop a search that defines remote login from a different geolocations within 1 hour?

nazanin2016
Path Finder

I need to define Remote login from different locations within 1 hour, but my vpn log doesn't have information concerning the country, it just shows the IP. How can I do that?

0 Karma

woodcock
Esteemed Legend

Just use the built-in iplocation command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Iplocation

Like this:

Your Base Search Here (assuming field named "clientip") | iplocation clientip | stats count values(clientip) BY City Country
0 Karma

nazanin2016
Path Finder

Thanks, should I update the iplocation in splunk, I found
http://dev.maxmind.com/geoip/geoip2/geolite2/

0 Karma

nazanin2016
Path Finder

Thanks,for most of the field it turned back nothing in country, should I update the iplocation in splunk, I found
http://dev.maxmind.com/geoip/geoip2/geolite2/

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...