how we can identify peoples region in Splunk ?

[nikhilagrawal]

Hello Team,

We have use case where we need to map/identify people's region in Splunk and create dashboard. Can we do something in Splunk?
we want to be able to write some performance dashboards and categorise people as internal/external and what region (UK/US/APAC/Other)

thanks
Nik

[nikhilagrawal]

Its mainly application logs indexed to Splunk and we are trying to create performance dashboard categorise people as internal/external and region (UK/US/APAC/Other).

[PPape]

Can you give some more information?
What Datasources do you have?

It is possible to make performance dashboards and filter to regions.

I did something like this. A Worldmap where the locations with a bad latency get marked.

[nikhilagrawal]

Its mainly application logs indexed to Splunk and we are trying to create performance dashboard categorise people as internal/external and region (UK/US/APAC/Other).

[PPape]

Ok, how can you seperate them? Are they all in an Active Directory?
Do they use diffrent subnets?

[nikhilagrawal]

all users are in Active directory

[PPape]

ok then you can use this data. Why don't you use the "c" attribute of the user? normally there should the country of the user be. and you could use the department attribute for the external users.