geoip search results not correct

The observed behavior is a postprocess-limitation of Splunk. When you take a look at the default maps view, you will notice that results are being post-processed. If you search through Splunkbase, youl'll find multiple discussions regarding the 10k postprocess limitation.

The results are summarized behind the scenes for the user. The module will automatically apply the following postprocess-search to the base-search:

eval _geo_count=coalesce(_geo_count,1) | stats sum(_geo_count) as _geo_count by _geo

So the results are aggregated to the count results by unique (distinct) location. The resulting number of records is usually lower by an order of a magnitude in most cases.

eg. when dealing with geo-ip database based results, there will not be a huge number of unique locations, since the number of records in the GeoCity Light database is not that big. A lot of IP addresses share the same location.

The GoogleMaps module will only fetch 100,000 results from the search endpoint. This is a hard-coded limitation at the moment, since the browser won't be able to handle more records at a time.

A better approach is to summarize the result in the base-search, by searching for something like:

sourcetype=something src_ip=* | stats count as _geo_count by src_ip | geoip src_ip | search _geo=* | stats sum(_geo_count) as _geo_count by _geo

Here's a short explaination what this search does:

sourcetype=something src_ip=*

Reduce the result in the base search to those events that contain the relevant IP field

| stats count as _geo_count by src_ip

Aggregate by distinct IP address

| geoip src_ip

Do the geo-ip lookup

| search _geo=*

Filter out those results that do not contain geo-information

| stats sum(_geo_count) as _geo_count by _geo

Aggregate again to the the summarized count of events by distinct location (ie. distinct combination of latitude and longitue).

If you're really dealing with a even bigger number of distinct locations (more than 100k), which I doubt, then you will need to perform some kind of server-side clustering. There will be support for accurate geo-clustering in a future version of the Google Maps app. In the meanwhile you can use the kmeans command or craft a custom search command.

sourcetype="*" | geoip ???

How can that work. You need to pass a field like a src_ip or client_ip to that search so geoip knows what to graph. Whatever your IP address field is called, just use that in the search:

sourcetype="*" | geoip src_ip

does this mean that the geoip plugin has that huge problem and no one has ever fixed it??

It's very unlikely that this is a major bug that has gone unnoticed until now. More likely it's a problem with your configuration.

Also remember that this is a community-based forum, that means a lot of people who read it are probably on vacation or busy with the holidays.

The argument to geoip must be the IP you want to lookup. For example:

 * | geoip src

where src is the field containing the IP.

You must pass the field name that contains the IP addresses after the geoip command or it will not work.

In case you want to take a look at the limits, they are established on $SPLUNK_HOME/etc/system/default/limits.conf, find the one you'd like to change, create a new limits.conf and place under:

$SPLUNK_HOME/etc/system/local/limits.conf