Splunk Search

iplocation and counting ips

khhenderson
Path Finder

This is kind of a newbie question.

I found the iplocation command and have had some success with it but. The searches seem a little slow. Is this due to the fact it's using the web for the City and Country lookup? Secondly, I'm trying to count the clientip field along with the iplocation.

This works:

sourcetype=access_combined | stats count by clientip | where count > 500

This doesn't return the City:

sourcetype=access_combined | stats count by clientip | where count > 500 | iplocation | table count, clientip, City

This works, but I'd like to count the clientip:

sourcetype=access_combined |dedup clientip | iplocation | table clientip, City, Country

Thanks for the help.

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes, it is slow because it running over the web. This will work:

sourcetype=access_combined | iplocation | stats count, first(City) as City, first(Country) as Country by clientip

Ideally, this will work:

sourcetype=access_combined  | stats count by clientip | iplocation

But it doesn't because the iplocation commmand is rather poorly implemented and requires the ip address to simply exist somewhere in the raw text of the data, rather than being able to specify a field (it wouldn't be terribly hard to modify the code for it though in /opt/splunk/etc/apps/search/bin/iplocation.py). If it did though, it would be faster because it should have fewer lookups to perform.

You may want to look at the ammap and google maps apps in Splunkbase instead.

http://splunk-base.splunk.com/apps/22282/geo-location-lookup-script-powered-by-maxmind

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes, it is slow because it running over the web. This will work:

sourcetype=access_combined | iplocation | stats count, first(City) as City, first(Country) as Country by clientip

Ideally, this will work:

sourcetype=access_combined  | stats count by clientip | iplocation

But it doesn't because the iplocation commmand is rather poorly implemented and requires the ip address to simply exist somewhere in the raw text of the data, rather than being able to specify a field (it wouldn't be terribly hard to modify the code for it though in /opt/splunk/etc/apps/search/bin/iplocation.py). If it did though, it would be faster because it should have fewer lookups to perform.

You may want to look at the ammap and google maps apps in Splunkbase instead.

http://splunk-base.splunk.com/apps/22282/geo-location-lookup-script-powered-by-maxmind

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...