Refine your search:

19
3

Thanks For Downloading!

Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows:

Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into %PROGRAMFILES%\Splunk\etc\apps. Then restart Splunk using the splunk restart command or the GUI.

Unix/Linux: Decompress the downloaded file using a tool like tar -xvf and place the resulting folder into $SPLUNK_HOME/etc/apps. Then restart Splunk using the splunk restart command or the GUI.

Description

Google Maps for Splunk adds a geo-visualization module based on the Google Maps API and allows you to quickly plot geographical information on a map. Furthermore maps can be embedded in advanced dashboards.

Professional Services and Support

This add-on has been developed by SPP (http://www.spp.at/), a Splunk Partner located in Vienna, Austria. If you require support on getting solutions using Google Maps up and running, please contact splunk@spp.at.

Licence and Terms of Use

This app is licensed under the terms of the Creative Commons license and provided as-is without any warranty. It uses thrird-party components that are licensed differently:

Using the Google Maps Search View

The App provides a flashtimeline-like view which allows you to simply enter a search and display the results on the map. In order to plot search results on the map they have to have some kind of location information attached. This location information has to be included in a field with the name _geo and has to be formatted as "<latitude>,<longitude>". Latitude and Longitude have to be expressed as floating point numbers. As an example "47.11,0.815" would be a valid _geo value. Other notations (like 47°12',...) are not supported.

In most cases you don't have to build the _geo field yourself. The built-in geolocation lookup methods (geoip command and geo lookup) are emitting this field by default. In cases where you already have geolocation information in your results, you can leverage the geonormalize command to build the _geo value for you.

Geolocation Lookup for IP addresses

Performing Gelocation Lookup on external IP addresses

External IP address values can be easily translated to locations by using the built-in geoip command or the geo lookup.

Examples:

Perform a geolocation lookup for values of the clientip field in access_combined events:

sourcetype=access_combined | geoip clientip

Same as the previous example, but also perform DNS lookups in case when the value of the clientip field is a hostname and not an IP:

sourcetype=access_combined | geoip clientip resolve_hostnames=true

Same as the first example, but using the geo lookup instead of the command

sourcetype=access_combined | lookup geo ip as clientip

Performing Gelocation Lookup on internal IP addresses

In order to perform geolocation lookup on private IP address ranges you have to implement a lookup yourself. Splunk provides multiple ways to achieve this:

  • Creating a CSV with the IP subnets and their locations and leveraging the CIDR match_type
  • Creating a scripted lookup which queries the geolocation information from an existing asset management system.

Performing combined Geolocation Lookup on IP adresses

Lookups for external and interal IP addresses can be easily combined.

Examples:

sourcetype=access_combined clientip=*
| lookup geoip_internal ip as clientip
| geoip clientip


sourcetype=access_combined clientip=*
| lookup example_geo_internal ip as clientip
| lookup geo ip as clientip OUTPUTNEW _geo geo_info

Use existing geolocation information available in search results

It's common case that events already contain geo information.

The geonormalize command

The geonormalize command can detect existing fields containing the geoinformation and normalizes them for the GoogleMaps module. For doing this the command searches for field pairs (a latitude field and a longitude field) matching a name scheme. The values of those fields are then merged and emitted as the _geo field. The following name schemes are supported:

  • *lat/*lng
  • *lat/*lon
  • *latitude/*longitude

So for example when an event has the fields gps_lat=47.11 and gps_lon=0.815 the geonormalize command will detect those fields and emit the _geo field with the value 47.11,0.815.

Example:

sourcetype=device_tracking device_id=A47C08B13 | geonormalize

Manual building the _geo field

If you don't want to use the geonormalize command or if the location fields do not match any naming scheme, you can manually build the _geo field.

Example:

eventtype=phone_activation | eval _geo=phone_loc_1+","+phone_loc_2

(Assuming that phone_loc_1 contains the latitude and phone_loc_2 contains the longitude)

Creating Dashboards with Google Maps

This add-on provides a Splunk UI module called GoogleMaps. This module can only be using in *advanced XML* dashboards. The usage of the module is quite similar to any built-in module in Splunk which displays results (like SimpleResultsTable, EventsViewer, etc.).

Example:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true">
<param name="search">sourcetype=access_combined | geoip clientip</param>
<param name="earliest">-24h@h</param>
<module name="GoogleMaps">
<param name="height">500px</param>
<param name="mapType">roadmap</param>
<param name="scrollwheel">off</param>
</module>
</module>

All available options to the module can be found at the module reference at your Splunk instance at http://localhost:8000/modules#Splunk.Module.GoogleMaps

Versions and Release Notes

Version 1.1 (current version - updated May 31, 2011)
show older versions »
Version 1.1 (updated May 31, 2011)
release notes:
Internal changes The module now uses the _geo field instead of the _lat and _lng fields to resolve the location. The geoip and the geonormalize command are now emitting this field. It contains the combined latitude/longitude information in the form <lat>,<lng> (eg. 47.11,0.815). Geolocation Lookup The geolocation lookup now uses the Maxmind GeoLite City database. The geoip command is now emitting different fields: <field>_latitude, <field>_longitude, <field>_country_name, <field>_country_code, <field>_region_name, <field>_city, and the _geo field UI Changes - More configuration options for the module - Scrollwheel zooming is turned off by default - Streetview is turned off - Introduced opacity for cluster icons (Only in Browsers supporting native opacity). - Added new mapStyles (See dark view). - The module now persist settings like center, zoom and map style. - Removed fields side-panel - Added 2 panel to kind-of debug the results (Geo Results and Events) Drilldown
Version 1.0.1 (updated Aug 31, 2010)
release notes:
Google Maps Version 1.0.1 - Enhanced clustering of the results displayed on the Google Map - Improved performance for both the geoip and geonormalize command - Added a custom results header in the maps view which displays the count of results with geo information as well as the count of distinct locations

posted 12 Aug '10, 13:36

ziegfried's gravatar image

ziegfried ♦
5.8k1315
accept rate: 52%

new version 31 May '11, 17:08


6 Reviews:
1 rating

Hi,

Firstly great app!

One question though... When load a view with map on, the results are populated... only after I have manually dragged the map around. I wasn't sure if I need to use a certain "param" for this rendering.

Regards,

MHibbin

reviewed 20 Jan, 07:57

MHibbin's gravatar image

MHibbin
60416
accept rate: 23%

The results should render instantly. This sounds like a bug. What browser are you using?

(20 hours ago) ziegfried ♦

why geoip only shows some events but not all...? supposably it has to show 4 million events for a sourcetype, it only shows 19,000!!

reviewed 26 Dec '11, 17:20

nina15's gravatar image

nina15
715
accept rate: 0%

Using this on 4.3 and my overall CSS gets completely whacked out. Have you tested it on 4.3 yet?

reviewed 02 Nov '11, 16:29

Simon%20Shelston's gravatar image

Simon Shelston
25316
accept rate: 37%

What build and client OS/browser are you using? Just tried it with 4.3 beta build 111122 in Firefox and Safari and it seems to work fine.

(07 Nov '11, 05:25) ziegfried ♦

+1 works on 4.3. but if you don't have an internet connection, you'll get errors.

(14 Feb, 23:29) monzy

Yup, Google Maps requires an internet connection.

(20 hours ago) ziegfried ♦

is it possible to look up lat/long using zipcode if its already available in the search data?

reviewed 01 Sep '11, 15:22

tven7's gravatar image

tven7
684
accept rate: 0%

Yes, this is possible. The app itself does not supply such a lookup table. You have to add it yourself (you should be able to find such a list on the internet somewhere easily). The lookup table has to supply the latitude and longitude. You can either use the geonormalize command after the lookup or use the eval command to construct the _geo field manually (see app description on how to do that).

(17 Oct '11, 13:52) ziegfried ♦

Great app! Thanks a lot for sharing with the community.

Does it support commercial version of the MAXMIND db?

reviewed 09 Jun '11, 03:16

Alexandre%20Nizoux's gravatar image

Alexandre Ni...
213
accept rate: 0%

Yes, you should be able to use the commercial database from maxmind as well.

(24 Jun '11, 08:28) ziegfried ♦

Hi,

as far as I can see, IPInfoDB has changed its format... Do yu plan to migrate your app to the new format?

cheers, Andy

P.S.: Great App!!

reviewed 02 May '11, 23:36

kochera's gravatar image

kochera
3113
accept rate: 0%

edited 02 May '11, 23:37

Actually no, since they also changed their usage terms, the Maxmind geolocation database will be leveraged instead.

(05 May '11, 11:10) ziegfried ♦
Your review

Did you find this app useful?

Preview toggle preview

Details

This app was not developed by Splunk, and as such it is not covered by any support agreements in place with the company. If you have questions about the installation or operation of this app, please contact the author.

Version 1.1
Last Updated: May 31, 2011
Download Add-on

By downloading, you agree to the author's License and Splunk's Terms and Conditions

Downloading Terms & Conditions: Most of the applications and content on this site are submitted by parties other than us. That third-party content is the sole responsibility of the originator of that content. We are not responsible for any third-party content, whether or not we reviewed or moderated such content. You agree that you bear all risks associated with using or relying on applications and content on this site. We do not in any way warrant the accuracy, reliability, completeness, usefulness, non-infringement, or quality of any applications or content on this site, regardless of who originated that content (including our employees, partners, affiliates or moderators), and even if an application is designated as "certified". We hereby disclaim all warranties, including but not limited to any implied warranties of merchantability or fitness for a particular purpose, relating to such applications or content. We shall not be liable or responsible in any way for any losses or damage of any kind, including lost profits or other indirect or consequential damages, relating to your use of or reliance upon any applications or content on this site.

Author: ziegfried
Version: 1.1
Splunk compatibility: 4.3, 4.2
Price: Free
License: Creative Commons BY-NC-SA 2.5
Downloads: 11,632

Follow this app

Log In to enable email subscriptions

RSS:

Reviews

Reviews + Comments

Copyright © 2005-2012 Splunk, Inc. All rights reserved.