2,306
edits
Changes
Jump to navigation
Jump to search
mLine 69:
Line 69: + + Line 104:
Line 106: − + Line 111:
Line 113: + + + + + +
no edit summary
from splunk_lookup import SplunkLookup
from splunk_lookup import SplunkLookup
from geoip2 import database
from geoip2 import database
from geoip2.errors import AddressNotFoundError
DB_PATH = '/usr/share/geoip/GeoIP2-City.mmdb'
DB_PATH = '/usr/share/geoip/GeoIP2-City.mmdb'
locator = Geolocator(argument_value1)
locator = Geolocator(argument_value1)
return locator.location
return locator.location
except Exception as e:
except (AddressNotFoundError, ValueError, TypeError):
return 'Unknown'
return 'Unknown'
SplunkLookupGeoIP()
SplunkLookupGeoIP()
</syntaxhighlight>Define your lookup At Splunk (Settings > Lookups > Lookup definitions)
[[File:Splunk Lookup Definition.png|alt=Splunk Lookup Creation|left|frameless|800x800px|Splunk Lookup Creation]]
<br />
===Query Usage Example===
<syntaxhighlight lang="text">
sourcetype="pfsense:filterlog" host="pfsenseoperacionesinternet.rra.lan" dest_int=pppoe0 direction=inbound vendor_action=block | lookup GeoIP ipaddr as src_ip OUTPUT location | stats count by src_ip, location, dest_port, vendor_action | sort -num(count), sort num(src_ip), sort str(location), sort num(dest_port)
</syntaxhighlight>
</syntaxhighlight>