Thanks For Downloading!Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows: Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into Unix/Linux: Decompress the downloaded file using a tool like DescriptionSplunk for Use with MAXMIND is an application that provides geo_ip information on any public IP in your Splunk DB in a scalable fashion. The GeoIPCityLite DB is apart of the app so no internet connection is required and lookups are performed locally on your search head.
. Versions and Release Notes
Version 1.0.6 (current version - updated Apr 12, 2011)
release notes:
Updated the app.conf to improve compatibility with Splunk 4.2
Version 1.0.5
(updated Sep 20, 2010)
release notes:
Added fix for distributed deployments issue
Version 1.0.4
(updated May 26, 2010)
Version 1.0.3
(updated Mar 03, 2010)
Version 1.3
(updated Mar 03, 2010)
Version 1.2
(updated Mar 03, 2010)
Version 1.0.1
(updated Feb 17, 2010)
Version 1.0
(updated Feb 17, 2010)
|
The download is broken. but the file starts to download then you can not use it.
This works really well. After you run a search with the lookup included, your list of fields will now contain country, region, city, longitude and lattitude. These can be used affect the search. For instance, adding a pipe after the table lookup and doing |client_country!="United States". Very cool. Instead of the regex above (which works) I am using '| rex field=_raw "b(?<ip>(?:d{1,3}.){3}d{1,3})b" | lookup geoip clientip as ip'. I've stored this as a macro, including the leading pipe. I use it like this:
index="syslogs" geoip | ...rest of search...
