Hi there, has it worked for anyone? Couldn't find any documentation like others.
Also, can it work on Splunk 6.x ?
Thanks!
I'm on Splunk 6 and it's working fine. What problem are you having with it?
Documentation is in the README.txt, so you have to look in the filesystem where the app is installed.
@bigmuse85 The lookup
command does not exactly work as you expect (and I myself can never remember): If the IP address is not in the field ip
, add AS my_ip_field
, which in your case would be ... | lookup whoisLookup ip AS c_ip
.
Could anyone help me get this working? I installed it per the instructions and restarted Splunk. I'm piping input that contains an IP field of "c_ip" to "| lookup whoisLookup c_ip" and I get the error "Error in 'lookup' command: The lookup table 'whoisLookup' does not exist."
I'm on Splunk 6 and it's working fine. What problem are you having with it?