Get Started With IP2location Splunk Add-on
Dependencies
This add-on requires IP2Location BIN database to function. You may download the BIN database at
IP2Location LITE BIN Data (Free): https://lite.ip2location.com
IP2Location Commercial BIN Data (Comprehensive):https://www.ip2location.com
Requirements
Splunk Enterprise or Splunk Enterprise Cloud >=8.0.
Installation
Follow the instructions in Github to build IP2Locationpy.
Install the IP2Locationpy on each search head.
Navigate to the IP2Locationpy App in the Splunk Web Interface.
Sample Codes
Query geolocation information
You can query the geolocation information by using codes below:
| NOOP | stats count | EVAL src="8.8.4.4" | `ip2locationpy(src)`IP2Location Sample Database (BIN)
The sample BIN files have a limited scope and are only valid for the following IP ranges:
- IPv4 : 0.0.0.0 - 7.255.255.255
- IPv6 : 2a04:0000:0000:0000:0000:0000:0000:0000 - 2a04:ffff:ffff:ffff:ffff:ffff:ffff:fff
