Getting Data In

combine search results with external data

janfabo
Explorer

Hello,

I have csv file with geo coordinates of my internal ip's. I dont know how to combine it with google maps. could you please provide me hints how to do that?

Thank you.

1 Solution

chris
Motivator

Hi,

Sigi Puchbauer helped me with this once. This is how he suggested to solve the issue:

You create an additional internal lookup that you can use to lookup internal ips

... | lookup geoip clientip | lookup internal_geoip ip as clientip OUTPUTNEW _geo

The internal_geoip Lookup is a CSV File with the following format:

ip,_geo
"10.1.1.0/24","47.11,8.15"
"10.1.2.0/24","77.11,-8.15"

In $SPLUNK_HOME/etc/system/default/transforms.conf the lookup has to be configured to make a CIDR match:

[internal_geoip]
filename = internal_geoip.csv
match_type = CIDR(ip)

You can then create a macro that does both lookup for you to make the searches easier

... | `geoip(clientip)`

View solution in original post

chris
Motivator

Hi,

Sigi Puchbauer helped me with this once. This is how he suggested to solve the issue:

You create an additional internal lookup that you can use to lookup internal ips

... | lookup geoip clientip | lookup internal_geoip ip as clientip OUTPUTNEW _geo

The internal_geoip Lookup is a CSV File with the following format:

ip,_geo
"10.1.1.0/24","47.11,8.15"
"10.1.2.0/24","77.11,-8.15"

In $SPLUNK_HOME/etc/system/default/transforms.conf the lookup has to be configured to make a CIDR match:

[internal_geoip]
filename = internal_geoip.csv
match_type = CIDR(ip)

You can then create a macro that does both lookup for you to make the searches easier

... | `geoip(clientip)`

janfabo
Explorer

great, it's working. Thank you, chris.

0 Karma

chris
Motivator

I'v just edited the answer. This file is a good place to start /opt/splunk/etc/system/local/transforms.conf. If you start developing your own apps it will be in /opt/splunk/etc/apps//default/transforms.conf

0 Karma

janfabo
Explorer

Thank you Chris for your answer.

I have few transforms.conf on server and I don't know which one to use:

/opt/splunk/etc/apps/MAXMIND/default/transforms.conf
/opt/splunk/etc/apps/maps/default/transforms.conf
/opt/splunk/etc/apps/SplunkforSquid/default/transforms.conf
/opt/splunk/etc/system/default/transforms.conf

I want to create a dashboard, which will display the number of IP addresses if the ip address match CIDR in a csv file.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...