Add on which can be used to list the country name from client_ip

[ranjyotiprakash]

Is there any add-on that can be used with my splunk app which can be able to list the country name from the client_ip ? And, I want to know how to package this add on with my app so that i can be able to use it in my app.

[sdaniels]

Change it to be sourcetype="firewall" | lookup geoip clientip | rename clientip AS client_ip. When you put the 'AS' in there it does not work but you can still rename the field.

You should now see the fields under field discovery like client_city, Client_country etc...that you can now use.

[ranjyotiprakash]

Thanks ... it worked for me

[Ayn · Accepted solution]

Yes, the MAXMIND app provides this functionality: http://splunk-base.splunk.com/apps/22282/geo-location-lookup-script-powered-by-maxmind

It provides a custom lookup command - require users to install this separate app in order to have geoip lookup work.

[ranjyotiprakash]

i got the results

[ranjyotiprakash]

Thanks a lot ...

[Ayn]

When you say you're not getting the correct results. What do you mean? Are you getting results, but not the results you expected? Or are you not getting new fields from the maxmind lookup at all?

[ranjyotiprakash]

thanks for the answer..But, I am not getting the results. It is just showing the logs.
I am having client_ip field in firewall logs and I am using

sourcetype="firewall" |lookup geoip clientip AS client_ip

But, I am not getting the correct results.I want to know how to use this to get details with respect to an IP ?