Getting additional (IP/network/location) info along with your Splunk searches

Chanced upon some of the info by accident (smack at the bottom of one part of the Splunk documentation…), but I can’t find it now.  Going to share here anyway 😀

Some (or probably most/all) of your searches might involve public IP addresses, and more often than not we would want to have additional info along with the IP address to work with.

Three of the things that we could do in Splunk automatically would be to get IP-location info, or to reverse lookup an IP to a domain, or to lookup a domain to an IP.

1. Geolocation

There’re two ways to do geolocating of IPs: using the iplocation command, or to use the MAXMIND app.

1a. iplocation

The command iplocation is described as:

Finds ips in _raw and looks up the IP location using the hostip.info database. IPs are extracted as ip1, ip2, etc. Cities and Countries are likewise extracted.

What we only need to do is to pipe the search to iplocation and let it do the rest!  The lookups are done from the server on the fly, so make sure that the server is able to do whois/ns lookups on the network.

index=myindex | iplocation

1b. MAXMIND app

Like previously mentioned before: install the MAXMIND app, then pipe the field containing IPs to the lookup (the field name must be clientip, if not this will not work duh)

This can work with the server not having any internet connectivity, but the accuracy is entirely dependant on the cached MAXMIND database.

index=myindex | lookup geoip clientip

or

index=myindex2 | lookup geoip clientip as fieldwithip

2, 3. IP-hostname or hostname-IP

These two items are pretty similar.  Spunk 4 comes with a lookup script called external_lookup.py, and the config is already in the default transforms.conf.  So we only need to use it!

Resolving IPs to hostnames:

index=myindex | lookup dnslookup clientip

Resolving hostnames to IPs:

index=myindex | lookup dnslookup clienthost

(no screenshot, sorry :P)


Leave a comment if this helped, or if you want to ask anything!

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s