TEST COMMAND
---------------IPInfo ------------------
| makeresults 1 | eval ip_add="1.186.41.179" | ipinfo ip_add | table ip, city, region, country, loc, postal, hostname
---------------IPInfo ------------------
| makeresults | eval ip="197.94.71.228,197.94.71.227,197.94.71.221,197.94.71.226,197.94.71.225,197.94.71.230" | makemv delim="," ip | mvexpand ip | ipinfo ip
-------------- IPInfo Batch ------------
| ipinfobatch ip="197.94.71.228,197.94.71.227,197.94.71.221 , 197.94.71.226,197.94.71.225 ,197.94.71.22"
-------------- privacyinfo ------------
| makeresults | eval ip="23.24.240.0" | privacyinfo ip
-------------- rangesinfo ------------
| makeresults | eval domain="comcast.net" | rangeinfo domain
-------------- domaininfo ------------
| makeresults | eval ip="1.1.1.1" | domaininfo ip
-------------- Configuration ------------
Just update ip_info_setup.conf in $SPLUNK_HOME/etc/apps/ip_info/local/
[api_configuration]
api_url = https://ipinfo.io/
token = <your token here>
and restart Splunk
AVAILABILITY OF FIELDS
BASIC SUBSCRIPTION - ip, city, region, country, loc, org, postal, hostname
STANDARD SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type
PRO SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type, company_name, company_domain, company_type, carrier_name, carrier_mcc, carrier_mnc
INSTALLATION AND CONFIGURATION
https://github.com/neelmamania/IPInfo-App-for-Splunk/blob/master/Installation%20and%20Configuration.pdf
API REQUEST LIMITS
https://blog.ipinfo.io/give-credit-get-requests-double-your-free-request-limit-to-100k-month-de70449eb654
Feature to Add custom rootCA certificate.
Feature to Disable the SSL verification.
Couple of other Bug fixes.
Updating `ipinfo` command to support ipinfo bulk api
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.