All Apps and Add-ons

GeoIP for domain names

hartfoml
Motivator

Has anyone tried to do a lookup for domain names to work with the Google Maps App?

0 Karma

hartfoml
Motivator

I have a distributed Search Environment do I need to install the add on to all the indexers or just the search head?

I think the search below might work but I don't know if I have the subsearch right.

Foo=Mysearch domain=* [| lookup whoisLookup ip] | geoip ip

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Have you tried it to see if it works? Are you running into an issue?

0 Karma

hartfoml
Motivator

Yes but given the IP address from the Whois app mentioned below I could use the IP address in the Google Maps app to map the IP, right???

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Do you mean…
- given an fqdn, lookup it's ip address(es)
- convert those to lat/lon
- plot on a map?

0 Karma

yannK
Splunk Employee
Splunk Employee

if you want domain informations, use the whois app.

http://apps.splunk.com/app/321/

0 Karma

hartfoml
Motivator

Also if I have a distributed Search Environment do I need to install the add on to all the indexers or just the search head?

0 Karma

hartfoml
Motivator

here is the search that I do with GeoIP
foo=MySearch dest_ip=* | geoip dest_ip

If I wanted to use the Domsain Name with Whois and GeoIP apps, how could I combine them.

Foo=Mysearch domain=* [| lookup whoisLookup ip] | geoip ip

0 Karma