All Apps and Add-ons

Google Maps and Exchange App

davidts
Path Finder

I am using version 2.1.0 of the Exchange App with Splunk 5.0.2. It is working great, but there is one thing that I need help on configuring. I have downloaded and installed the Google Maps app, but I can not find any instructions on how to get it to work with the Exchange app.

Tags (1)
0 Karma

treinke
Builder

While I am not familiar with the Exchange app, you need to find the field that contains IP addresses. You then can add the:

 | geoip IPFIELD

to your search to give you information on the ip address. IT will then give you some new fields.

IPFIELD_city,IPFIELD_region_name,IPFIELD_country_name, etc.

Or in this example, I use a reguluar expression to find a pattern for ip addresses. This is for IIS logs but could be used for any log. (you need to remove the space between < and clientip>):

eventtype=iislogs | rex "(?< clientip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search NOT (clientip="192.168.*.*" OR clientip="10.*.*.*")| geoip clientip
There are no answer without questions
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...