Mapping your Client IPs (Using Geo Lookup)
Use this query to display on a map the geo locations where your you are getting hits from (Source IPs). Search our documentation for additional fields available, like country_name, region, zip code, etc. https://help.sumologic.com/Search/Search_Query_Language/Search_Operators/Geo_Lookup
_sourceCategory=elb_aws_logs
| lookup latitude, longitude from geo://default on ip=client_ip
| count by latitude, longitude
| sort _count
-
Hi Michael - sorry to hear you're getting some misplaced IPs. If the database cannot find a match for the IP address, it will resolve to a default location (in this particular case, Kansas). We are actively working on upgrading to a more accurate database - we will keep you posted when that is available!
Please sign in to leave a comment.
Comments
3 comments