icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading whois add on
SHA256 checksum (whois-add-on_30.tgz) 8ad935032f051b69f810dc7b0ba81b2ea42805227a9b6cb18a9b356f5ff5cd23 SHA256 checksum (whois-add-on_20.tgz) 56dce21a16725a5a1553a80477e99f6f7a81a6f8fb7a35bb97108f7525e1e4f6 SHA256 checksum (whois-add-on_101.tgz) b88d2c6f91478de2b5a74379df08c07424d26857cae93bc000d7ccb77c239856 SHA256 checksum (whois-add-on_10.tgz) 2e29f677ab61ad91679df9d5f65ee29bf7d40c6ef88be0ac8232fcf5a791cea0
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


whois add on

This app is NOT supported by Splunk. Please read about what that means for you here.
These 2 add-ons provide 2 different ways to perform a whois. The included
whois library is open source with MIT license from:
https://github.com/DannyCork/python-whois. The user is free to use this as is
or can subsitute their own whois library within the code.

Both parts of this add-on are used in the context of a Splunk app.
A requirement is that your data contains external IP addresses that can be used
for workflow actions and/or look up commands. First extract your IP addresses
from your index data. See the Splunk Docs on how to extract a field. For
example, I have used ip as the name of my field. This is then used as input
to the look up and the work flow actions. READ the include README.txt for installation.


First, identify the app that you would like to use for this add-on. As
mentioned, the app's indexed data must have a field that contains an IP
address. If you do not have an app that has been created, but you do
have data that has been indexed with an extractable IP address, you can use
the Splunk search app.

Look UP

Copy this add-on's bin/whois_lookup.py into your own app's bin directory.
Copy -R this add-on's bin/whois library into your own app's bin directory.
Then, within the app's local directory (or default directory if you wrote
it yourself), copy the content of this add-on's default/transforms.conf into
your own transforms.conf file. If you do not have a transforms.conf, create
a new one in your apps's local or default directory

Search Usage:

*|lookup whoisLookup ip OUTPUT whois

This will create a new whois field for all events that contain an extracted
field called ip at search time. The whois field contains whois information
in JSON format created by the open source who is library.

NOTE: Because there is no caching used here, it will not be a good idea to
send thousands of events to this lookup command as each event will make
an external call to the LOCATION_URL web site. It may be better to narrow
down your search such as:

*|head 50|lookup whoisLookup ip OUTPUT whois


*|dedup ip|lookup whoisLookup ip OUTPUT whois


ip=|head 1|lookup whoisLookup ip OUTPUT whois

Version 2.x and onward (OPTIONAL)

Version 2.x and onward adds support for the Redis key value database to cache
all responses from the whois lookup query. The theory is that the whois
response hardly changes for an address, so having a local cache of the data
speeds up the query. Here's what you have to do to use this version,

1) First, install Redis from http://redis.io/
You will need access to make (and possibly gcc). On a Mac, install XCode first.

2) Next, install the Redis Python Module, which produces an egg file.


3) Finally, in the whois_redis_lookup.py file, change the following lines:

Change: sys.path.append("/Library/Python/2.6/site-packages/redis-2.4.5-py2.6.eg
by putting in the absolute path to your redis...egg file.

Change: pool = redis.ConnectionPool(host='localhost', port=6379, db=0)
by putting in the name of your your host, port, and db, if different.

Start the redis-server. See the Redis docs on how to start it.
Now instead of using whois_lookup.py as described above in your transforms.conf
and lookup searches, you can now use whois_redis_lookup.py in its place.

Workflow Action

Copy the contents of the default/workflow_actions.conf into your own app's
local or default/workflow_actions.conf file. If you do not have such a file,
create a new one.

Usage: After retrieving data that has an IP address, use the field picker menu
on the UI to pick ip as a field to view on the events list. Then, under the
ip field in the events list, you will see a pulldown menu that will have
a new entry called whois. Click on this whois menu item to perform a whois
for this particular field value.

Note that if your extracted field is called something other than ip, you can
change the contents of workflow_actions.conf for this workflow action to use
your field extraction name instead of the word ip.

Release Notes

Version 3.0
May 26, 2021

Changed to use open source library https://github.com/DannyCork/python-whois/ which uses MIT License for distribution. Changed workflow action to use www.whois.com.

Version 2.0
July 12, 2011

Added new optional lookkup, whois_redis_lookup.py, that uses the Redis database to cache the results.

Version 1.0.1
May 18, 2010
Version 1.0
May 3, 2010

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.