Good afternoon.
I am new to Splunk and need assistance with the google maps app.
I am logging postfix logs, and using MAXMIND, can create a graph with the top foreign sources which connect to our servers.
This is useful when visualizing compromised accounts.
I use the following search:
host="smtp" source="/var/log/mail" | rex field=_raw "(?
I would like to show these results as the top region connecting but i cannot get the google maps app to reflect the results of the search, even though the graph works fine.
your assistance would be appreciated
The field you are extracting seems to be 'ip' and that is what you'll need to pass to the geoip lookup.
...| lookup geoip ip | ...
Also for your search after the lookup you do not need client_country="*" since it's already searching everything, just put your NOT expression.
| search NOT client_country="South Africa"
The field you are extracting seems to be 'ip' and that is what you'll need to pass to the geoip lookup.
...| lookup geoip ip | ...
Also for your search after the lookup you do not need client_country="*" since it's already searching everything, just put your NOT expression.
| search NOT client_country="South Africa"
Thank you very much.
worked perfectly.