I have basic questions about hte way to geolocate devices with Splunk
Is an addon exists?
If not, is it possible to correlate a tool like NetDB with Splunk using DB Connect?
If yes, what are the prerequesites for doing this?
I don't see an app on splunkbase, but that doesn't mean you can't use the NetDB API to create one.
If there's a JDBC driver for NetDB then you may be able to use DB Connect.
For public IP address space, Splunk comes with an | iplocation function with data accurate as of the Splunk package being published.
iplocation - Splunk Documentation
The documentation comes with info on how to update the database.
OK but it will do no work for me because it's not public adress but internal adress