Hello,
I am using the Whois Add On to get Whois information from ip addresses. Here is an example:
index=pan* dest!=192.168.0.0/16 dest!=10.0.0.0/8 dest!=172.16.0.0/12 | dedup dest | head 3 | rename dest as ip | lookup whoisLookup ip OUTPUT whois | table _time ip whois
It creates a new field called whois, with the information from the online whois database:
['{"DomainName":"8.8.8.8","RegistryData":{"AbuseContact":{"Email":"arin-contact@google.com","Name":"Google Inc","Phone":"+1-650-253-0000"},"AdministrativeContact":{"Email":"arin-contact@google.com","Name":"Google Inc","Phone":"+1-650-253-0000"},"BillingContact":null,"CreatedDate":"2014-03-14T16:52:05-04:00","RawText":null,"Registrant":{"Address":"1600 Amphitheatre Parkway","City":"Mountain View","Country":"US","Name":"Google Inc.","PostalCode":"94043","StateProv":"CA"},"TechnicalContact":{"Email":"arin-contact@google.com","Name":"Google Inc","Phone":"+1-650-253-0000"},"UpdatedDate":"2014-03-14T16:52:05-04:00","ZoneContact":null}}']
I am trying to use spath to extract the fields from the JSON results, but no success yet... I´ve read somewhere that Splunk 6 extract the JSON fields automatically... Well... Any idea how to extract the fields, in order to present the results in a more organized way? That would help a lot! 🙂
Thanks!
... View more