Please find full documentation at https://github.com/ipinfo/splunk-docs
| Data Type | Fields Included |
|---|---|
| Lite Bundle | ip, asn, as_name, as_domain, country_code, country, continent_code, continent |
| Core Bundle | ip, city, region, region_code, country, country_code, continent, continent_code, latitude, longitude, timezone, postal_code, asn, as_name, as_domain, as_type, is_anonymous, is_anycast, is_hosting, is_mobile, is_satellite |
| Plus Bundle | ip, city, region, region_code, country, country_code, continent, continent_code, latitude, longitude, timezone, postal_code, dma_code, geoname_id, radius, geo_changed, asn, as_name, as_domain, as_type, as_changed, carrier_name, mcc, mnc, is_anonymous, is_anycast, is_hosting, is_mobile, is_satellite, is_proxy, is_relay, is_tor, is_vpn, privacy_name |
| Location | ip, city, country, lat, lon, postal, region, region_code, timezone, geoname_id |
| Location Extended | ip, city, country, country_name, lat, lon, postal, radius, region, region_code, timezone, geoname_id |
| Location Extended Labels | ip, city, city_confidence, country, country_confidence, country_name, lat, lon, postal, radius, region, region_confidence, region_code, timezone, geoname_id |
| Location Aggregated | ip, city, country, lat, lon, postal, region, region_code, timezone, geoname_id |
| ASN | asn_asn, asn_name, asn_domain, asn_route, asn_type |
| Company | company_name, company_domain, company_type |
| Carrier | carrier_name, carrier_mcc, carrier_mnc, carrier_cc, carrier_network |
| Privacy | vpn, proxy, tor, hosting, relay, service |
| Privacy Extended | anycast, census, census_port, device_activity, hosting, network, proxy, relay, tor, vpn, vpn_config, vpn_name, whois |
| Domains | total_domains, domains |
| Abuse | abuse_address, abuse_country, abuse_name, abuse_email, abuse_network, abuse_phone |
| Country ASN | country_asn_domain, country_asn_name, country_asn_asn, country_continent, country_continent_name, country_country, country_country_name |
| Residential Proxy | resproxy_last_seen, resproxy_percent_days_seen, resproxy_service |
ipinfolite| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfolite IP
ipinfolite (prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfolite IP prefix=true
ipinfolite (custom prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfolite IP prefix="my_prefix_"
ipinfolite (restapi)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfolite IP restapi=true
ipinfocore| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfocore IP
ipinfocore (prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfocore IP prefix=true
ipinfocore (custom prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfocore IP prefix="my_prefix_"
ipinfocore (restapi)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfocore IP restapi=true
ipinfoplus| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfoplus IP
ipinfoplus (prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfoplus IP prefix=true
ipinfoplus (custom prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfoplus IP prefix="my_prefix_"
ipinfoplus (restapi)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfoplus IP restapi=true
| makeresults 1
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfo IP
ipinfo| makeresults count=2000
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, IP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time IP
| ipinfo IP
ipinfo (Multi)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, SRCIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, DESTIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time SRCIP DESTIP
| ipinfo SRCIP DESTIP
ipinfo (prefix)| makeresults count=100
| eval IP1=random()%192, IP2=random()%210, IP3=random()%230, IP4=random()%192, SRCIP='IP1'.".".'IP2'.".".'IP3'.".".'IP4'
| table _time SRCIP
| ipinfo prefix=true SRCIP
ipinfo (privacy)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP privacy=true
ipinfo (asn)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP asn=true
ipinfo (company)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP company=true
ipinfo (abuse)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP abuse=true
ipinfo (domains)| makeresults
| eval IP="8.8.8.8"
| ipinfo IP domains=true
ipinfo (carrier)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP carrier=true
ipinfo (country_asn)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP country_asn=true
ipinfo (resproxy)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP resproxy=true
ipinfo (resproxy with 7 days lookback)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP resproxy=true resproxy_lookback=7
ipinfo (alltypes)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP alltypes=true
ipinfo (restapi)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP restapi=true
ipinfo (restapi with alltypes)| makeresults
| eval IP="1.0.178.0"
| ipinfo IP restapi=true alltypes=true
ipinforesproxy| makeresults
| eval IP="1.0.178.0"
| ipinforesproxy IP
ipinforesproxy (prefix)| makeresults
| eval IP="1.0.178.0"
| ipinforesproxy IP prefix=true
ipinforesproxy (with 7 days lookback)| makeresults
| eval IP="1.0.178.0"
| ipinforesproxy IP lookback=7
shclustering.deployer_push_mode = full setting from server.conf, now the default value merge_to_default is used if not explicitly set by the userreplicationSettings.maxBundleSize = 2048 from distsearch.conf, now the default value 2048 is used if not explicitly set by the userFix automatic download of residential proxy DB not working
Internal changes
Bug fixes:
- IPinfo token and proxy password credentials fetching re-implemented using Python SDK (previous implementation made direct call to /servicesNS/admin/search/search/jobs)
Bug fixes:
- make sure that all Python scripts are executable
- prevent collision when Splunk Enterprise Security changes Python module path
Upgraded Splunk Python SDK to v2.1.0
splunklib from 1.7.4 to 2.2.0 to support Python 3.9.urllib.request to requests due to unauthorized issues.PLEASE NOTE: If you are setting up the app again after re-installation, we recommend bumping splunk (https://<yourSplunk>/en-US/_bump)
Support for streaming (only with mmdb)
other minor bugfixes.
If you are setting up the app again after re-installation, we recommend bumping splunk (https://<yourSplunk>/en-US/_bump)
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.