2,306
edits
Changes
Jump to navigation
Jump to search
mLine 9:
Line 9: − + Line 24:
Line 24: − ipfield = sys.argv[2] + − location = sys.argv[1] + − + Line 65:
Line 65: − + + Line 105:
Line 106: − + Line 112:
Line 113: + + + + + +
no edit summary
class SplunkLookup:
class SplunkLookup:
__metaclass__ = ABCMeta
__metaclass__ = ABCMeta
usage = "Usage: python {} [arg1] [arg2]"
usage = "Usage: python {} [arg1] [arg2]".format(__file__)
def __init__(self):
def __init__(self):
@staticmethod
@staticmethod
def read_arguments():
def read_arguments():
arg1 = sys.argv[1]
arg2 = sys.argv[2]
return ipfield, location
return arg1, arg2
@staticmethod
@staticmethod
class SplunkLookupError(object):
class SplunkLookupError(object):
pass
pass
</syntaxhighlight>Create your own lookup in: /opt/splunk/etc/system/bin
</syntaxhighlight>Create your own lookup in: /opt/splunk/etc/system/bin
Example : geoip.py<syntaxhighlight lang="python">
Example : geoip.py<syntaxhighlight lang="python">
from splunk_lookup import SplunkLookup
from splunk_lookup import SplunkLookup
from geoip2 import database
from geoip2 import database
from geoip2.errors import AddressNotFoundError
DB_PATH = '/usr/share/geoip/GeoIP2-City.mmdb'
DB_PATH = '/usr/share/geoip/GeoIP2-City.mmdb'
locator = Geolocator(argument_value1)
locator = Geolocator(argument_value1)
return locator.location
return locator.location
except Exception as e:
except (AddressNotFoundError, ValueError, TypeError):
return 'Unknown'
return 'Unknown'
SplunkLookupGeoIP()
SplunkLookupGeoIP()
</syntaxhighlight>Define your lookup At Splunk (Settings > Lookups > Lookup definitions)
[[File:Splunk Lookup Definition.png|alt=Splunk Lookup Creation|left|frameless|800x800px|Splunk Lookup Creation]]
<br />
===Query Usage Example===
<syntaxhighlight lang="text">
sourcetype="pfsense:filterlog" host="pfsenseoperacionesinternet.rra.lan" dest_int=pppoe0 direction=inbound vendor_action=block | lookup GeoIP ipaddr as src_ip OUTPUT location | stats count by src_ip, location, dest_port, vendor_action | sort -num(count), sort num(src_ip), sort str(location), sort num(dest_port)
</syntaxhighlight>
</syntaxhighlight>