All Apps and Add-ons

Syntax to manually input IPs into Google Maps or other suggestions?

MikeMallia
Engager

I am trying to manually input IPs into Google Maps on a Splunk instance running version 4.3.2, build 123586 (yes, I know that is old). Does anyone know the syntax I should use? These IPs are not in any log being indexed by Splunk. I just want to use the Google Maps application to map them out. To take this one step further, I have the IPs (400+) in a spreadsheet. Any suggestions in how to "feed" that spreadsheet in? Thanks you for any help.....

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Great, don't forget to mark this as solved.

0 Karma

MikeMallia
Engager

Thanks very much!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!