All Apps and Add-ons

Syntax to manually input IPs into Google Maps or other suggestions?

MikeMallia
Engager

I am trying to manually input IPs into Google Maps on a Splunk instance running version 4.3.2, build 123586 (yes, I know that is old). Does anyone know the syntax I should use? These IPs are not in any log being indexed by Splunk. I just want to use the Google Maps application to map them out. To take this one step further, I have the IPs (400+) in a spreadsheet. Any suggestions in how to "feed" that spreadsheet in? Thanks you for any help.....

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Great, don't forget to mark this as solved.

0 Karma

MikeMallia
Engager

Thanks very much!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.