Geolocation data missing when searching

Graylog Add-ons
1

Using the geolocation plug in. I have also added the Sonicwall Content pack. If I look at messages received I see can dst_ip_geolocation and src_ip_geolocation and if I do a search with just the the source import

gl2_source_input:595e3aaf83224e0e1b25d857

I can see the geolocation fields, but if I add to the search

gl2_source_input:“595e3aaf83224e0e1b25d857” AND (msg:“XAUTH Succeeded with VPN client” OR m:139) then the geolocation fields are no longer showing. Any help would be much appreciated.

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.