SecKit for geolocation with MaxMind
Overview
Details
This supporting add-on (SA) for Splunk advanced IP information enrichment using the MaxMind family of databases.
Welcome
This supporting add-on (SA) for Splunk advanced IP information enrichment using the MaxMind family of databases.
https://www.maxmind.com/en/geoip2-databases
Supported
City2Lite
City2 (optional)
ISP (optional)
ConnectionType (optional)
Installation search head only
- Install the SecKit_SA_geolocation app
- Configure the geoipupdate input with your account details if using the commercial license option
USAGE Note "fieldname" must be actual field
| `seckit_iplocation(fieldname)`
| `seckit_iplocation(fieldname,prefix)`Where fieldname is the name of the field containing the IP
prefix is the prefix to assign to the output fields
Example 1
| NOOP | stats count | EVAL src="8.8.4.4" | `seckit_iplocation(src)`Example 2
tag=network tag=communicate | `seckit_iplocation(src,"geo")`FIELDS
- city (City/CityLite)
- country (City/CityLite)
- lat (City/CityLite)
- long (City/CityLite)
- connection_type (ConnectionType)
- isp (ISP)
- isp_organization (ISP)
- isp_ip (ISP)
- isp_asn (ISP)
- isp_asn_organization (ISP)
Source
https://bitbucket.org/splservices/seckit_sa_geolocation
Legal
- Splunk is a registered trademark of Splunk, Inc.
- MaxMind is a registered trademark of MaxMind, Inc.
Release Notes
Version 4.0.0Rf2f3c6a
June 4, 2019
-Replaced method of storing license key added in 3.1.x to allow Splunk Cloud vetting
Version 3.1.4R40ed5b8
May 12, 2019
Add binary declaration for appinspect 1.7
Version 2.0.5
Sept. 1, 2016