Alternative to GeoASN ?

[dm1]

Since geoASN has been long gone, can anyone please suggest what is a better alternative to it ?

Mainly need the ASN info for an IP.

[max-ipinfo · Accepted solution]

Feel free to use the IPinfo Splunk app. It comes with robust country and ASN information for free. The ASN data is backed by BGP announcements pointing to original ownership and authority, and is enriched with WHOIS data. 

Here is the documentation to get started:

https://ipinfo.io/developers/splunk 

You need to set up the IPinfo Lite API or the database download (preferable).

App link: https://splunkbase.splunk.com/app/4070

[dm1]

I am getting this SyntaxError  while using the IPinfo Splunk App on my Splunk Enterprise instance.

Environment Details:

• Splunk Version: 9.2.2

• App Name: IPinfo Splunk App

• OS: Linux

Problem Description: When running the ipinfo command in a search, the command fails. Upon inspecting the search.log, I found that the external search command is exiting with a SyntaxError.

It appears the script ipinfo_command.py uses the assignment expression (Walrus Operator :=), which was introduced in Python 3.8. However, even on Splunk 9.2.2, the script is being invoked using the bundled Python 3.7 interpreter in my environment, leading to the following error:

ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/ipinfo_app/bin/ipinfo_command.py", line 139
ERROR ChunkedExternProcessor - stderr: ip_addresses = [v.strip() for f in fields if (v := record.get(f)) and v.strip()]
ERROR ChunkedExternProcessor - stderr:                                                                   ^
ERROR ChunkedExternProcessor - stderr: SyntaxError: invalid syntax
ERROR ChunkedExternProcessor - Error in 'ipinfo' command: External search command exited unexpectedly with non-zero error code 1.

[VatsalJagani]

@dm1 - This App should help.

IPInfo App for Splunk - https://splunkbase.splunk.com/app/4070

Kindly upvote and accept the answer if this help !!