TEST COMMAND
---------------IPInfo ------------------
| makeresults 1 | eval ip_add="1.186.41.179" | ipinfo ip_add | table ip, city, region, country, loc, postal, hostname
---------------IPInfo ------------------
| makeresults | eval ip="197.94.71.228,197.94.71.227,197.94.71.221,197.94.71.226,197.94.71.225,197.94.71.230" | makemv delim="," ip | mvexpand ip | ipinfo ip
-------------- IPInfo Batch ------------
| ipinfobatch ip="197.94.71.228,197.94.71.227,197.94.71.221 , 197.94.71.226,197.94.71.225 ,197.94.71.22"
-------------- privacyinfo ------------
| makeresults | eval ip="23.24.240.0" | privacyinfo ip
-------------- rangesinfo ------------
| makeresults | eval domain="comcast.net" | rangeinfo domain
-------------- domaininfo ------------
| makeresults | eval ip="1.1.1.1" | domaininfo ip
-------------- Configuration ------------
Just update ip_info_setup.conf in $SPLUNK_HOME/etc/apps/ip_info/local/
[api_configuration]
api_url = https://ipinfo.io/
token = <your token here>
and restart Splunk
AVAILABILITY OF FIELDS
BASIC SUBSCRIPTION - ip, city, region, country, loc, org, postal, hostname
STANDARD SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type
PRO SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type, company_name, company_domain, company_type, carrier_name, carrier_mcc, carrier_mnc
INSTALLATION AND CONFIGURATION
https://github.com/neelmamania/IPInfo-App-for-Splunk/blob/master/Installation%20and%20Configuration.pdf
API REQUEST LIMITS
https://blog.ipinfo.io/give-credit-get-requests-double-your-free-request-limit-to-100k-month-de70449eb654
Support for Splunk Search Head Cluster
Merging ipinfolookup capability with original ipinfo command
privacyinfolookup to now be privacyinfo
domaininfolookup to now be domaininfo
rangesinfolookup to now be rangesinfo
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.