Thanks For Downloading!Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows: Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into Unix/Linux: Decompress the downloaded file using a tool like DescriptionGoogle Maps for Splunk adds a geo-visualization module based on the Google Maps API and allows you to quickly plot geographical information on a map. Furthermore maps can be embedded in advanced dashboards. Professional Services and SupportThis add-on has been developed by SPP (<http://www.spp.at/>), a Splunk Partner located in Vienna, Austria. If you require support on getting solutions using Google Maps up and running, please contact splunk@spp.at. Licence and Terms of UseThis app is licensed under the terms of the Creative Commons license and provided as-is without any warranty. It uses thrird-party components that are licensed differently:
Using the Google Maps Search ViewThe App provides a flashtimeline-like view which allows you to simply enter a search and display the results on the map. In order to plot search results on the map they have to have some kind of location information attached. This location information has to be included in a field with the name _geo and has to be formatted as "<latitude>,<longitude>". Latitude and Longitude have to be expressed as floating point numbers. As an example "47.11,0.815" would be a valid _geo value. Other notations (like 47°12',...) are not supported. In most cases you don't have to build the _geo field yourself. The built-in geolocation lookup methods (geoip command and geo lookup) are emitting this field by default. In cases where you already have geolocation information in your results, you can leverage the geonormalize command to build the _geo value for you. Geolocation Lookup for IP addressesPerforming Gelocation Lookup on external IP addressesExternal IP address values can be easily translated to locations by using the built-in geoip command or the geo lookup. Examples:Perform a geolocation lookup for values of the clientip field in access_combined events: Performing Gelocation Lookup on internal IP addressesIn order to perform geolocation lookup on private IP address ranges you have to implement a lookup yourself. Splunk provides multiple ways to achieve this:
Performing combined Geolocation Lookup on IP adressesLookups for external and interal IP addresses can be easily combined. Examples:
Use existing geolocation information available in search resultsIt's common case that events already contain geo information. The geonormalize commandThe geonormalize command can detect existing fields containing the geoinformation and normalizes them for the GoogleMaps module. For doing this the command searches for field pairs (a latitude field and a longitude field) matching a name scheme. The values of those fields are then merged and emitted as the _geo field. The following name schemes are supported:
So for example when an event has the fields Example: Manual building the _geo fieldIf you don't want to use the geonormalize command or if the location fields do not match any naming scheme, you can manually build the _geo field. Example: Creating Dashboards with Google MapsThis add-on provides a Splunk UI module called Example: All available options to the module can be found at the module reference at your Splunk instance at <http://localhost:8000/modules#Splunk.Module.GoogleMaps> Versions and Release Notes
Version 1.1.2 (current version - updated Aug 21, 2012)
release notes:
Fixed issue with chrome not loading the API when SSL is enabled
Version 1.1.1
(updated May 29, 2012)
release notes:
- Fixed some UI issues:
Version 1.1
(updated May 31, 2011)
Version 1.1
(updated May 31, 2011)
release notes:
Internal changes The module now uses the _geo field instead of the _lat and _lng fields to resolve the location. The geoip and the geonormalize command are now emitting this field. It contains the combined latitude/longitude information in the form <lat>,<lng> (eg. 47.11,0.815). Geolocation Lookup The geolocation lookup now uses the Maxmind GeoLite City database. The geoip command is now emitting different fields: UI Changes - More configuration options for the module Drilldown
Version 1.0.1
(updated Aug 31, 2010)
release notes:
Google Maps Version 1.0.1 - Enhanced clustering of the results displayed on the Google Map |
Hi ziegfried,
Thanks for the great app. We have been using it at our workplace extensively. However, our mgmt is requesting a map that would show multiple parameters in a single view, for example, response_time, number_of_hits, number_of_ipv4_addr, etc in a one single representation. Would this be possible?
Kalpana
Great app! Very easy to use! The only glitch I've hit is that for one particular search, it seems to stop after 18000 total, not unique, geolocations. I am totally sure the search I am using to feed this app returns way more IPs than just 18000.
I'd totally recommend this app anyway
Great app! Thanks a lot for sharing with the community.
Does it support commercial version of the MAXMIND db?
Yes, you should be able to use the commercial database from maxmind as well.
Hi,
as far as I can see, IPInfoDB has changed its format... Do yu plan to migrate your app to the new format?
cheers, Andy
P.S.: Great App!!
Actually no, since they also changed their usage terms, the Maxmind geolocation database will be leveraged instead.