Syntax to manually input IPs into Google Maps or other suggestions?

[MikeMallia]

I am trying to manually input IPs into Google Maps on a Splunk instance running version 4.3.2, build 123586 (yes, I know that is old). Does anyone know the syntax I should use? These IPs are not in any log being indexed by Splunk. I just want to use the Google Maps application to map them out. To take this one step further, I have the IPs (400+) in a spreadsheet. Any suggestions in how to "feed" that spreadsheet in? Thanks you for any help.....

[martin_mueller · Accepted solution]

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

[martin_mueller]

Great, don't forget to mark this as solved.

[MikeMallia]

Thanks very much!