Adding information about the IP address to each event

The following example adds information about the IP address to each event:

...| iplocation clientip

Return only specific fields after adding IP address information to each event

The following example add information about the IP address to each event. This example uses the select command to display only certain fields in the search results:

...| iplocation clientip | select _time, ipaddress, Country, Region, City

See also