All Apps and Add-ons

Syntax to manually input IPs into Google Maps or other suggestions?

MikeMallia
Engager

I am trying to manually input IPs into Google Maps on a Splunk instance running version 4.3.2, build 123586 (yes, I know that is old). Does anyone know the syntax I should use? These IPs are not in any log being indexed by Splunk. I just want to use the Google Maps application to map them out. To take this one step further, I have the IPs (400+) in a spreadsheet. Any suggestions in how to "feed" that spreadsheet in? Thanks you for any help.....

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

martin_mueller
SplunkTrust
SplunkTrust

Great, don't forget to mark this as solved.

0 Karma

MikeMallia
Engager

Thanks very much!

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...