Please find full documentation at https://github.com/ipinfo/splunk-docs
| Data Type | Fields Included |
|---|---|
| Location | ip, city, region, country, loc, org, postal, hostname |
| ASN | asn_asn, asn_name, asn_domain, asn_route, asn_type |
| Company | company_name, company_domain, company_type |
| Carrier | carrier_name, carrier_mcc, carrier_mnc |
| Privacy | vpn, proxy, tor, hosting, relay, service |
| Domains | total_domains, domains |
| Abuse | abuse_address, abuse_country, abuse_name, abuse_email, abuse_network, abuse_phone |
| makeresults 1
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfo IP
ipinfo| makeresults count=2000
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfo IP
ipinfo (Multi)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, SRCIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, DESTIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time SRCIP DESTIP
| ipinfo SRCIP DESTIP
ipinfo (prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, SRCIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time SRCIP
| ipinfo prefix=true SRCIP
ipinfo (privacy)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP privacy=true
ipinfo (asn)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP asn=true
ipinfo (company)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP company=true
ipinfo (abuse)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP abuse=true
ipinfo (domains)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP domains=true
ipinfo (carrier)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP carrier=true
ipinfo (alltypes)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP alltypes=true
Bug fixes:
- make sure that all Python scripts are executable
- prevent collision when Splunk Enterprise Security changes Python module path
Upgraded Splunk Python SDK to v2.1.0
splunklib from 1.7.4 to 2.2.0 to support Python 3.9.urllib.request to requests due to unauthorized issues.PLEASE NOTE: If you are setting up the app again after re-installation, we recommend bumping splunk (https://<yourSplunk>/en-US/_bump)
Support for streaming (only with mmdb)
other minor bugfixes.
If you are setting up the app again after re-installation, we recommend bumping splunk (https://<yourSplunk>/en-US/_bump)
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.