TEST COMMAND
---------------IPInfo ------------------
| makeresults count=20
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfo IP
-------------- IPInfo --------------------- (Multi)
| makeresults count=20
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, SRCIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, DESTIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time SRCIP DESTIP
| ipinfo SRCIP DESTIP
-------------- IPInfo --------------------- (prefix)
| makeresults count=10
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, SRCIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time SRCIP
| ipinfo prefix=true SRCIP
-------------- IPInfo --------------------- (privacy)
| makeresults count=20
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192,
SRCIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192,
DESTIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time SRCIP DESTIP
| ipinfo prefix=true privacy=true SRCIP, DESTIP
-------------- IPInfo Batch ------------
| ipinfobatch ip="197.94.71.228,197.94.71.227,197.94.71.221 , 197.94.71.226,197.94.71.225 ,197.94.71.22"
-------------- privacyinfo ------------
| makeresults | eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'| privacyinfo IP
-------------- rangesinfo ------------
| makeresults | eval domain="comcast.net" | rangeinfo domain
-------------- domaininfo ------------
| makeresults | eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4' | domaininfo IP
-------------- Configuration ------------
Just update ip_info_setup.conf in $SPLUNK_HOME/etc/apps/ip_info/local/
[ip_info_configuration]
api_url = https://ipinfo.io/
token = <your token here>
and restart Splunk
AVAILABILITY OF FIELDS
BASIC SUBSCRIPTION - ip, city, region, country, loc, org, postal, hostname
STANDARD SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type
PRO SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type, company_name, company_domain, company_type, carrier_name, carrier_mcc, carrier_mnc
INSTALLATION AND CONFIGURATION
https://github.com/neelmamania/IPInfo-App-for-Splunk/blob/master/Installation%20and%20Configuration.pdf
API REQUEST LIMITS
https://blog.ipinfo.io/give-credit-get-requests-double-your-free-request-limit-to-100k-month-de70449eb654
Minor BugFixes
If you are setting up the app again after re-installation, we recommend bumping splunk (https://<yourSplunk>/en-US/_bump)
Adding a privacy=true flag so that the results are returned as part of the ipinfo command
Support for multiple fields in one go , for example | ipinfo prefix=true src_ip, dest_ip
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.