whois on Splunk 6?

[nitinsheenu]

Hi there, has it worked for anyone? Couldn't find any documentation like others.

Also, can it work on Splunk 6.x ?

Thanks!

[Wilcooley]

Documentation is in the README.txt, so you have to look in the filesystem where the app is installed.

@bigmuse85 The lookup command does not exactly work as you expect (and I myself can never remember): If the IP address is not in the field ip, add AS my_ip_field, which in your case would be ... | lookup whoisLookup ip AS c_ip.

[bigmuse85]

Could anyone help me get this working? I installed it per the instructions and restarted Splunk. I'm piping input that contains an IP field of "c_ip" to "| lookup whoisLookup c_ip" and I get the error "Error in 'lookup' command: The lookup table 'whoisLookup' does not exist."

[vqd361 · Accepted solution]

I'm on Splunk 6 and it's working fine. What problem are you having with it?