Lab 6 - Plotting Clients on a Map
Learn to use the geo lookup operator to plot the location of your incoming requests on a map.
-
Run a search for all Apache Access logs and parse the ip address.
-
Use the ip address to search for the latitude and longitude coordinates
_sourceCategory=Labs/Apache/Access
| parse "* - -" as client_ip
| lookup latitude, longitude from geo://location on ip=client_ip
| count by latitude, longitude
| sort _count
-
Map your results.
Bonus: Edit your map to only show results for the US (country_code="US"). This will require additional fields other than just latitude and longitude. Check out the documentation for other fields available.
Optional: Test Your Knowledge
Using the extracted fields from the Apache Access Field Extraction Rule, build the following queries:
-
Count Number of Messages by Method
-
Scope: _sourceCategory=Labs/Apache/Access
-
Time Range: Last 45 Minutes (-45m)
-
Time slice by 1 minute
-
Count by method and timeslice
-
-
Count Number of 404 Error Messages by Method
-
Scope: _sourceCategory=Labs/Apache/Access and only 404 messages
-
Time Range: 15 minutes, but starting 30 Minutes ago (-45m -30m)
-
Time slice by 1 minute
-
Count by method and timeslice
-
-
Count Successes versus Failures
-
Scope: _sourceCategory=Labs/Apache/Access
-
Time Range: Nov 25 8:00 AM - Nov 25 8:45am
-
Count 2* messages as Successes and 4* messages as Failures
-
Sum Successes and Failures
-