Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading DocoDoco for Splunk
MD5 checksum (docodoco-for-splunk_102.tgz) 8b8308d91f941f551b401aa9660cf6a8 MD5 checksum (docodoco-for-splunk_101.tgz) 5fd223209db826eec1ecb49ac35a98af MD5 checksum (docodoco-for-splunk_100.tgz) 312c9ac58a737dbf71bfbd00ff70ecc1
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

DocoDoco for Splunk

Overview
Details
This add-on enables to add about 55 kinds of information for area, organization and environment to IP addresses, such as country, municipality, organizational name, business type and line, by tying up with “DocoDoco” which is a service offered by Cyber Research Area, Inc.

このアドオンは、サイバーエリアリサーチ株式会社のサービス「どこどこJP」と連携し
IPアドレスに対して国や都道府県市区町村、企業業名や業種、回線といった
計55種類の地域情報や組織情報、環境を付加することが出来るアドオンです。

Adding the information of area, organization and environment to IP addresses strengthens the visualization of machine data operated by Splunk in the aspect of web analytics; those are security analysis in the event of incidents as divulging of information, illegal login, targeted attack, and analysis of converted user.

IPアドレスに地域や組織、環境情報を付加できる事によって
情報漏えい、不正ログイン、標的型攻撃などのインシデント発生時のセキュリティ分析
コンバージョンしたユーザの分析等の Webアナリティクスの面において
splunkで行えるログの可視化を一層強化します。

You need to sign up with DocoDoco (fee-based) for using this application.

※このアプリケーションを使用する為には別途「どこどこJP」(有料)と契約する必要があります。

■どこどこJPについて
どこどこJPの詳細については下記のサイトをご参照下さい。
http://www.docodoco.jp/index.html

■About DocoDoco
Please refer to the following site for details of DocoDoco.
http://www.docodoco.jp/en/index.html

■導入方法
1.ダウンロード
 splunkbaseより「docodoco for splunk」をダウンロードします
2.インストール
 「docodoco for splunk」をsplunkにインストールします
3.どこどこJPに登録、APIキー取得
 どこどこJPに登録しAPIキーを取得します。(有料)
 登録、キーの取得については、下記のページをご参照下さい。
http://www.docodoco.jp/en/areatargeting/howto.html
4.どこどこJPAPIキーの設定
 「$SPLUNK_HOME$\etc\apps\docodoco/bin/config.ini」 の
 「key1」「key2」にどこどこJPのAPIキーを設定します。
  ※「count」はどこどこJPへの並列リクエスト数です。環境に合わせ変更して下さい。

*使用例
| lookup docodoco ipaddr as clientip
| lookup docodoco ipaddr as clientip output PrefJName OrgName DomainName

取得可能なデータは、どこどこJPのリターンパラメータに準拠します。
下記ページのリターンパラメータをご参照下さい。
http://www.docodoco.jp/areatargeting/rest.html

サードパーティデータの場合は、「パラメータ@親ノード名」になります。
―法人番号
| lookup docodoco ipaddr as clientip output HoujinBangou@HoujinBangou_3 HoujinName@HoujinBangou_3

―匿名ネットワーク
|lookup docodoco ipaddr as clientip output Name@AnonymousNetwork_5 Score@AnonymousNetwork_5 Info@AnonymousNetwork_5

―天気
天気予報 気温予報 降水確率 風向き予報は、「WeatherA」
気象現況 紫外線予報は、「WeatherP」として下さい。
| lookup docodoco ipaddr as clientip output TodayWeather@WeatherA Weather@WeatherP

■Method of installation
1. Download
Download “docodoco for splunk” from splunkbase.
2. Install
Install “docodoco for splunk to splunk.
3. Registration to DocoDoco and obtain API key
Please refer to the following page for the registration and API key.
4. Set up API key to DocoDoco
Set up API key of DocoDoco to “key 1” and “key 2” of 「$SPLUNK_HOME$\etc\apps\docodoco/bin/config.ini」
※ “count” is the number of parallel requests to DocoDoco. Please change it according to your environment.

Example
| lookup docodoco ipaddr as clientip
| lookup docodoco ipaddr as clientip output PrefJName OrgName DomainName

Available data complies with the return parameter of DocoDoco.
Please refer to the following page for the return parameter.
http://www.docodoco.jp/en/areatargeting/rest.html

In the case of Third party data, it will be "Parameter@Parent node name".
-corporate number
|lookup docodoco ipaddr as clientip output HoujinBangou@HoujinBangou_3 HoujinName@HoujinBangou_3

-Anonymized Network Data
http://www.docodoco.jp/fraud/index.html
|lookup docodoco ipaddr as clientip output Name@AnonymousNetwork_5 Score@AnonymousNetwork_5 Info@AnonymousNetwork_5

-wether
In the case of Weather forecast ,Temperature forecast,Chance of rain or Wind direction forecast ,"WeatherA"
In the case of Current weather situation or Ultraviolet forecast ,"WeatherP"
|lookup docodoco ipaddr as clientip output TodayWeather@WeatherA Weather@WeatherP

■制限等
・別途どこどこJPへの契約を行いAPIキーを取得する必要があります。
・どこどこJPへリクエストを行う為、インターネットへのアクセスが必須です。
・レスポンの応答速度は、インターネット環境等によって変化しますが
 CPU6コア10並列ので1000IP/分程度となります。

■Restrictions
・It is required to sign up with DocoDoco and get an API key.
・Internet access is essential for requesting DocoDoco.
・Response speed is 1000IP per minute for 10 parallel requests with CPU 6 core.
  *It varies according to internet environments

Release Notes

Version 1.0.2
June 21, 2016

:Bug Fix
Error occurs when the "weather option" is disabled

Version 1.0.1
April 15, 2016

Corresponding to the Third party data.

Version 1.0.0
March 1, 2016

1
Install
117
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

Splunk Certification Program

Splunk's App Certification program uses a specific set of criteria to evaluate the level of quality, usability and security your app offers to its users. In addition, we evaluate the documentation and support you offer to your app's users.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2017 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.