All Apps and Add-ons

Getting Data from google geolocation api into splunk

christianmuelle
Explorer

Hey there,

I want to get some geo location information based on mac address from google API

I got the nessesary data via the following search request:
index=wifi sourcetype=netxml
| dedup wireless-network.BSSID
| table wireless-network.BSSID

When I put the data manuel to a structured json file and run the following curl command i see a json responce:
curl -d @testmac.json -H "Content-Type: application/json" -i "https://www.googleapis.com/geolocation/v1/geolocate?key="API_KEY"

How can I automate that and import the location data to visualize it. I'm a newbee.

Thanks
Christian

0 Karma

jkat54
SplunkTrust
SplunkTrust

Using the curl command in TA-Webtools (https://splunkbase.splunk.com/app/4146/) you could do the following:

index=wifi sourcetype=netxml 
| fields wireless-network.BSSID
| dedup wireless-network.BSSID 
| eval header="{\"Content-Type\": \"application/json\"}" 
| eval data="OTHERJSONDATAHERE"
| curl method=post uri="https://www.googleapis.com/geolocation/v1/geolocate" headerfield=header datafield=data debug=true

OTHERJSONDATAHERE would be whats in your file, and it needs to be escaped... you can use existng fields in eval by using concat feature.

| eval newfield="{\"aManuallyEnteredjsonField\":\"".anExistingFieldInSplunk."\"}"

would create newfield with value of {"aManuallyEnteredjsonField":"valueOfFieldExistingInSplunk"}.

0 Karma

Damien_Dallimor
Ultra Champion

If I understand correctly , in order to achieve something fully integrated , SPL search -> HTTP POST with search data -> use JSON results to feed a SPL geo visualization command to a map viz , then you are probably going to need a custom search command

This search command could take the results of your search string , perform the HTTP POST and output the results in the returned JSON.

index=wifi sourcetype=netxml | dedup wireless-network.BSSID | table wireless-network.BSSID | yourcustomcommand | geostats count

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...