Splunk App that auto updates the max-mind database (used for iplocation
command)
The Splunk app auto updates MaxMind database. The database update happens automatically every week. Also, user can update database just by running a search query.
Proxy
from UI.SSL cert
validation from mmdb_configuration.conf file. (Caution: User is not recommend to disable the cert validation unless it is absolutely necessary.)We're transitioning to R2 presigned URLs
from MaxMind on 12th of March, 2024
.Version 3.0.0 (May 2023) * Fixed the security issue - Earlier the App was using an API endpoint with exposed LicenseKey in the URL, not it is using a proper authentication mechanism instead. * Fixed Splunk Cloud compatibility issue (check_for_secret_disclosure).
Upgrade Guide for version 3.0.0 from previous Version
* User has to reconfigure the Account ID
and License Key
in the MaxMind Database Configuration Page. (Prior to 3.0.0, only License Key was required)
* Post configuration please execute the validation steps:
* Run | maxminddbupdate
search from the Auto Update MaxMind Database
App.
* In ideal scenario, it should show message Max Mind Database updated successfully.
Upgrade Guide for version 2.0.0 from previous Version
* On-Prem Environment: Remove the App installed on Indexers separately. Upgrade the App on the SHs.
* Cloud: Just upgrade the App from Splunk Cloud UI.
* Post upgrade (for both On-Prem and Cloud) please execute the validation steps:
* Run | maxminddbupdate
search from the Auto Update MaxMind Database
App.
* In ideal scenario, it should show message Max Mind Database updated successfully.
to show that License key is updated successfully.
Provided support for search head cluster and resolve cloud app-inspect issue.
(Now the App updates MaxMind DB with scripted input that runs on all Search Heads in Search Head Cluster instead of scheduled search which executes only on one SH.)
Added app.manifest file for Splunk-cloud.
Changes to make compatible with the latest Splunk AppInspect - Dashboards version changed to 1.1.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.