|
Currently started using the geoASN app with the maxmind db's and it's working great on our sourcetypes with ip's, and | geoip lookups etc. What's the best way to report on only certain countries/cities that I am watching. Say i have a list of 50-100 countries or cities Maybe pass a inputlookup with those listed countries? Just curious best way to handle this. Current search being used is: sourcetype="access_combined" | lookup ga ip as clientip | stats count by country, org | sort - count |
Refine your search:
- Apps & Questions
- Apps
- Questions
- Users
- Tags
Markdown Basics
- *italic* or _italic_
- **bold** or __bold__
- link:[text](http://url.com/ "Title")
- image?
- numbered list: 1. Foo 2. Bar
- to add a line break simply add two spaces to where you would like the new line to be.
- basic HTML tags are also supported
Tags:
Asked: 17 May '12, 14:18
Seen: 548 times
Last updated: 17 May '12, 14:18