I am trying to manually input IPs into Google Maps on a Splunk instance running version 4.3.2, build 123586 (yes, I know that is old). Does anyone know the syntax I should use? These IPs are not in any log being indexed by Splunk. I just want to use the Google Maps application to map them out. To take this one step further, I have the IPs (400+) in a spreadsheet. Any suggestions in how to "feed" that spreadsheet in? Thanks you for any help.....
Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name
and pipe any search commands after that, including geoip
and the like.
For single values you can start your search like this:
| stats count | eval clientip = "1.2.3.4" | geoip clientip
That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.
Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name
and pipe any search commands after that, including geoip
and the like.
For single values you can start your search like this:
| stats count | eval clientip = "1.2.3.4" | geoip clientip
That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.
Great, don't forget to mark this as solved.
Thanks very much!