All Apps and Add-ons

GeoIP for domain names

hartfoml
Motivator

Has anyone tried to do a lookup for domain names to work with the Google Maps App?

0 Karma

hartfoml
Motivator

I have a distributed Search Environment do I need to install the add on to all the indexers or just the search head?

I think the search below might work but I don't know if I have the subsearch right.

Foo=Mysearch domain=* [| lookup whoisLookup ip] | geoip ip

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Have you tried it to see if it works? Are you running into an issue?

0 Karma

hartfoml
Motivator

Yes but given the IP address from the Whois app mentioned below I could use the IP address in the Google Maps app to map the IP, right???

0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

Do you mean…
- given an fqdn, lookup it's ip address(es)
- convert those to lat/lon
- plot on a map?

0 Karma

yannK
Splunk Employee
Splunk Employee

if you want domain informations, use the whois app.

http://apps.splunk.com/app/321/

0 Karma

hartfoml
Motivator

Also if I have a distributed Search Environment do I need to install the add on to all the indexers or just the search head?

0 Karma

hartfoml
Motivator

here is the search that I do with GeoIP
foo=MySearch dest_ip=* | geoip dest_ip

If I wanted to use the Domsain Name with Whois and GeoIP apps, how could I combine them.

Foo=Mysearch domain=* [| lookup whoisLookup ip] | geoip ip

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...