- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Private Geolocation searching: only sending la...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a desire to do geo-locating off IP addresses but due to privacy restrictions here, we can only send out of our firewall latitude and longitude, not report the IP address. Quantity shouldn't matter, but we are talking about reporting on anywhere from 100-1,000,000 IPs.
1) Do the provided apps convert the IP into lat & long locally or report the IP out to either Google or Maxmind?
2) If the IPs are reported to these companies or exit the building so to speak, can this be done locally with, say, the IP range and lat/long database, and pass that through to get a mapped representation?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Maxmind app does not send anything out (if it did searches would probably be horribly slow), it uses a local database that it checks IP's against and returns a long/lat based on that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree use the Maxmind database and download it locally, then you wont have to send anything out. That's what we do on our website. It's not 100% accurate, but it's in the 80% range, but their is nothing that is 100% or even close to that. So any statistics you draw from it you have to adjust to get a more accurate model with a statistical lower % of error
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually, I download the updated database when they come out and replace the entire database with the new data. We use it as a lookup table, just query against it. I posted a link to show you how we use it, but apparently it was removed. 😞
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you saying you download / update the database directly? If that is the case, do you just ingest it as a source or use it as a lookup table in the Search app? Or are you saying you downloaded the Maxmind script app?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I only have IP information, I do not have lat/long information. So, if I so a
search foo=bar ip=* | geoip ip
I'll get a mapped representation. My ask is if to get this result, the ip values are being passed outside of the splunk install on my local computer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Maxmind app does not send anything out (if it did searches would probably be horribly slow), it uses a local database that it checks IP's against and returns a long/lat based on that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I might be missing exactly what you want to do but with the google maps app you can specify lat/long and get a mapped representation. You don't need to have the IPs. You can use the _geo field like this if you have those fields in splunk already:
... | eval _geo = latitude+","+longitude
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
