IPInfo App for Splunk
Overview
Details
-------------------------------------------------------------
Until recently, the free plan was limited to 1,000 requests/day, and if you needed more than that, you’d need to upgrade to a paid plan. Now, we’re making our free plan even more powerful.
We’re upgrading free, authenticated usage (that is, with an access token) to 50,000 requests/month. If you don’t already have an access token, you can get one for free by creating an account.
Additionally, we’ve added a way for users to help track when they’re nearing their request limit. Users will now begin receiving emails when they approach the limit so that they can take any necessary action before seeing 429 errors.
On top of these improvements, we’re offering a way to increase your free request limit even further! For any free users who are willing to credit IPinfo with a link on their website or application, we’re doubling the standard limit to 100,000 requests/month.
Ref : https://blog.ipinfo.io/give-credit-get-requests-double-your-free-request-limit-to-100k-month-de70449eb654
TEST COMMAND
---------------IPInfo ------------------
| makeresults 1 | eval ip_add="1.186.41.179" | ipinfo ip_add | table ip, city, region, country, loc, postal, hostname
-------------- IPInfo Lookup -----------
| makeresults | eval ip="197.94.71.228,197.94.71.227,197.94.71.221,197.94.71.226,197.94.71.225,197.94.71.230" | makemv delim="," ip | mvexpand ip |lookup ipinfolookup ip
-------------- IPInfo Batch ------------
| ipinfobatch ip="197.94.71.228,197.94.71.227,197.94.71.221 , 197.94.71.226,197.94.71.225 ,197.94.71.22"
-------------- privacyinfolookup ------------
| makeresults | eval ip="23.24.240.0" | lookup privacyinfolookup ip
-------------- rangesinfolookup ------------
| makeresults | eval domain="comcast.net" | lookup rangesinfolookup domain
-------------- domaininfolookup ------------
| makeresults | eval ip="1.1.1.1" | lookup domaininfolookup ip
-------------- Configuration ------------
Just update ip_info_setup.conf in $SPLUNK_HOME/etc/apps/ip_info/local/
[api_configuration]
api_url = https://ipinfo.io/
token = <your token here>
and restart Splunk
AVAILABILITY OF FIELDS
BASIC SUBSCRIPTION - ip, city, region, country, loc, org, postal, hostname
STANDARD SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type
PRO SUBSCRIPTION - ip, city, region, country, loc, postal, hostname asn_asn, asn_name, asn_domain, asn_route, asn_type, company_name, company_domain, company_type, carrier_name, carrier_mcc, carrier_mnc
INSTALLATION AND CONFIGURATION
https://github.com/neelmamania/IPInfo-App-for-Splunk/blob/master/Installation%20and%20Configuration.pdf
API REQUEST LIMITS
https://blog.ipinfo.io/give-credit-get-requests-double-your-free-request-limit-to-100k-month-de70449eb654
Release Notes
Version 4.0.9
Support for Proxy Settings
Version 3.5.4
Bugfixes :
Issues with ipinfolookup command