topic Re: ipinfo in Splunk Search

ipinfo

ismail_salma198 — Mon, 22 Mar 2021 23:08:27 GMT

I am executing a query in splunk which is below :

but it is giving me following error

10 errors occurred while the search was executing. Therefore, search results might be incomplete

I have installed IPINFO app on splunk to get the carrier information.

scelikok — Tue, 23 Mar 2021 04:03:23 GMT

Your subsearch result format is not suitable for ipinfo command. You don't need to use subsearch.

Please try below; please use a specific index on your searches to help Splunk run faster

"10.19.10.10" "%ASA-6-722023" dest="*" | ipinfo dest

493669 — Tue, 23 Mar 2021 04:10:40 GMT

-------------- Configuration ------------

Just update ip_info_setup.conf in $SPLUNK_HOME/etc/apps/ip_info/local/

[api_configuration]
api_url = https://ipinfo.io/
token = <your token here>

and restart Splunk

ismail_salma198 — Tue, 23 Mar 2021 05:48:37 GMT

It works awesome Thank you man.

ismail_salma198 — Tue, 23 Mar 2021 05:50:07 GMT

Ur given solution worked. Much much appreciated. Thanks alot

Regards

Ismail Kalolwala