All Apps and Add-ons

Syntax to manually input IPs into Google Maps or other suggestions?

MikeMallia
Engager

I am trying to manually input IPs into Google Maps on a Splunk instance running version 4.3.2, build 123586 (yes, I know that is old). Does anyone know the syntax I should use? These IPs are not in any log being indexed by Splunk. I just want to use the Google Maps application to map them out. To take this one step further, I have the IPs (400+) in a spreadsheet. Any suggestions in how to "feed" that spreadsheet in? Thanks you for any help.....

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your best approach to feed that spreadsheet into Splunk without indexing its content is to export it as CSV and upload that as a lookup file. You can then load its content with | inputlookup lookup_name and pipe any search commands after that, including geoip and the like.

For single values you can start your search like this:

| stats count | eval clientip = "1.2.3.4" | geoip clientip

That creates an empty dummy event and then sets your manually entered IP, possibly through a $token$ set by an input field in a form.

martin_mueller
SplunkTrust
SplunkTrust

Great, don't forget to mark this as solved.

0 Karma

MikeMallia
Engager

Thanks very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...