2,306
edits
Changes
Jump to navigation
Jump to search
mLine 69:
Line 69: + + Line 104:
Line 106: − + Line 114:
Line 116: + + + +
no edit summary
from splunk_lookup import SplunkLookup
from splunk_lookup import SplunkLookup
from geoip2 import database
from geoip2 import database
from geoip2.errors import AddressNotFoundError
DB_PATH = '/usr/share/geoip/GeoIP2-City.mmdb'
DB_PATH = '/usr/share/geoip/GeoIP2-City.mmdb'
locator = Geolocator(argument_value1)
locator = Geolocator(argument_value1)
return locator.location
return locator.location
except Exception as e:
except (AddressNotFoundError, ValueError, TypeError):
return 'Unknown'
return 'Unknown'
[[File:Splunk Lookup Definition.png|alt=Splunk Lookup Creation|left|frameless|800x800px|Splunk Lookup Creation]]
[[File:Splunk Lookup Definition.png|alt=Splunk Lookup Creation|left|frameless|800x800px|Splunk Lookup Creation]]
<br />
<br />
===Query Usage Example===
<syntaxhighlight lang="text">
sourcetype="pfsense:filterlog" host="pfsenseoperacionesinternet.rra.lan" dest_int=pppoe0 direction=inbound vendor_action=block | lookup GeoIP ipaddr as src_ip OUTPUT location | stats count by src_ip, location, dest_port, vendor_action | sort -num(count), sort num(src_ip), sort str(location), sort num(dest_port)
</syntaxhighlight>