iplocation
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
Contents
iplocation
Synopsis
Extracts location information from ip addresses.
Syntax
iplocation maxinputs-opt
Arguments
- maxinputs-opt
- Syntax: maxinputs=<int>
- Description: Determines how many of the top results are passed to the script.
Description
Finds IPs in _raw and looks up the ip location using the hostip.info database ips are extracted as ip1,ip2 etc. and Cities and Countries are likewise extracted.
Examples
Example 1: Add location information (based on IP address).
... | iplocation
Example 2: Example usage
404 host="webserver1" | head 20 | iplocation