IPGeolocation.io Splunk App

1. Case 1: Single Stand Alone Splunk Installation (CLI)

Single standalone Splunk Enterprise Installation on Windows/*NIX

1. Unzip ipgeolocation_app.tar.gz
2. Copy the unzipped directory ipgeolocation_app to $SPLUNK_HOME/etc/apps/
3. Open CLI and restart Splunk using ./splunk restart --run-as-root

2. Case 2: Distributed Architecture

Single Indexer Single Search Head and Single Forwarder (Heavy or Universal) and Deployment server

$SPLUNK_HOME/etc/deployment-apps/

[serverClass:<SEARCHHEAD_SERVERCLASS>:app:< ipgeolocation_app >]
stateOnClient=enabled
restartSplunkd=true

3. Case 3: Distributed Architecture

Multiple non-clustered Indexers, Multiple non-clustered Search Heads, Forwarder (Heavy or Universal) and Deployment server

[serverClass:<SEARCHHEAD_SERVERCLASS>:app:< ipgeolocation_app >]
stateOnClient=enabled
restartSplunkd=true

4. Case 4: Distributed Architecture

Single Site Clustered Indexer, Clustered Search Heads and Forwarder (Heavy or Universal).

./splunk apply shcluster-bundle -target <URI>:<management_port> -auth <username>:<password>

5. Case 5: Standalone Installation (WEB)

1. On the Splunk Home Page, Click on “Manage”

Expand

1. On the Manage Apps page, Click on “Install app from file”

Expand

1. Select path for ipgeolocation.io Splunk app .tar.gz file and Click “Upload”

Expand

1. It is a good practice to restart the Splunk, please restart

1. API Configuration

Select Fetch Details via Rest API in the Lookup Method to use your API subscription in the ipgeolocation.io App for Splunk, provide the API Key for your API subscription in the Key for API Subscription, and select the plan for your API subscription. These are only 3 inputs required to use ipgeolocation.io API with Splunk.

Expand

Rest of the fields are optional in case of using the API. However, to access ipgeolocation.io API through a proxy, you can select Yes against Enable Proxy and provide proxy settings.

Here are the required proxy configuration details:

Expand

Finally, click Submit.

2. MMDB Configuration

Select Use MMDB option in the Lookup Method to use your database subscription on ipgeolocation.io with Splunk.

You have the following choices to setup the app for ipgeolocation.io databases:

1. ipgeolocation Command

Type: Streaming (operates row by row on search results)Supported Methods: API (Free and Paid), MMDBMin. Plan: FREE (API), any MMDB database

The ipgeolocation command is the primary lookup command. You pipe your search results through it and specify one or more fields that contain IP addresses. The command enriches each record with geolocation and optional extended data.

Syntax:

... | ipgeolocation <field> [field2 ...] [options]

Options:

Option	Type	Default	Description
liveHostname	bool		Perform a live reverse DNS lookup for the IP. PAID API only.
hostnameFallbackLive	bool		Try hostname from database first; fall back to live DNS if not found. PAID API only.
abuseContact	bool		Include abuse contact details (name, email, address). PAID API only.
dma	bool		Include the DMA (Designated Market Area) code. US-centric. PAID API only.
geoAccuracy	bool		Include accuracy radius and confidence level for the geolocation. PAID API only.
security	bool		Include security flags (VPN, proxy, Tor, bot, spam, known attacker). PAID API or security-capable MMDB.
allinfo	bool		Shortcut that enables liveHostname , abuseContact , dma , geoAccuracy , and security simultaneously.
prefix	bool		Prefix all output field names with the source field name. Automatically set to true when multiple IP fields are specified.
language	string	en	Response language for place names. Supported: en , de , ru , ja , fr , cn , es , cs , it , ko , fa , pt .

Examples:

Basic geolocation lookup on a field named src_ip :

index=firewall action=blocked
| ipgeolocation src_ip
| table _time, src_ip, location.city, location.country_name, isp, location.latitude, location.longitude

Lookup two IP fields simultaneously (auto-prefixes output fields):

index=web_proxy
| ipgeolocation src_ip dst_ip
| table src_ip_location.country_name, dst_ip_location.country_name

Full enrichment for a threat-hunting search:

index=sysmon EventCode=3
| rename SourceIp as src_ip
| ipgeolocation src_ip allinfo=true
| where security.is_tor=true OR security.is_known_attacker=true
| table _time, src_ip, location.country_name, security.is_tor, security.is_known_attacker, security.threat_score, abuse.email

Localized response in French:

index=access_combined
| rex field=_raw "(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| ipgeolocation client_ip language=fr
| table client_ip, location.country_name, location.city

Enrich with DMA code for US ad-targeting analysis:

index=cdn_logs country_code=US
| ipgeolocation ip dma=true
| stats count by location.dma_code, location.city
| sort -count

2. ipgeolocationbatch Command

Type: Generating (produces its own results, does not require piped input)Supported Methods: API (Free and Paid), MMDBMin. Plan: FREE (API)

The ipgeolocationbatch command is used when you have a static list of IPs and want to enrich them without a preceding search that generates records. Start your SPL with a | (pipe) to invoke a generating command.

Syntax:

| ipgeolocationbatch ips="<ip1>,<ip2>,..." [options]

Options: Identical to ipgeolocation ( liveHostname , hostnameFallbackLive , abuseContact , dma , geoAccuracy , security , allinfo , language ).

The ips parameter is required. Pass a comma-separated list of IP addresses.

Examples:

Quick ad-hoc lookup for a known list of suspicious IPs from a threat intel report:

| ipgeolocationbatch ips="185.220.101.1, 162.247.72.199, 198.98.54.11, 45.142.212.100"
| table ip, location.country_name, location.city, isp, security.is_tor, security.is_proxy

Combine with a lookup table of IOCs:

| inputlookup threat_iocs.csv
| fields ip_address
| map search="| ipgeolocationbatch ips=\"$ip_address$\" security=true"
| table ip, location.country_name, security.is_known_attacker, security.threat_score

Generate a geolocation report for IP ranges from a CIDR list:

| ipgeolocationbatch ips="8.8.8.8, 8.8.4.4, 1.1.1.1, 208.67.222.222" language=de
| table ip, location.country_name, location.city, asn.as_number, asn.organization

3. ipsecurity Command

Type: StreamingSupported Methods: API (PAID only)Min. Plan: PAID

The ipsecurity command is a focused security lookup. It returns only IP security intelligence fields: VPN, proxy, Tor, bot, spam, cloud provider flags, and a composite threat score. Use it when you specifically want security signals without pulling the full geolocation payload.

Syntax:

... | ipsecurity <field> [field2 ...] [prefix=true]

Options:

Option	Type	Default	Description
prefix	bool		Prefix output field names with the source field name. Auto-enabled when multiple IP fields are provided.

Examples:

Identify VPN/proxy users in your authentication logs:

index=auth sourcetype=okta action=success
| ipsecurity src_ip
| where security.is_vpn=true OR security.is_proxy=true
| stats count by user, src_ip, security.proxy_type, location.country_name
| sort -count

Alert on logins from Tor exit nodes:

index=auth action=login
| ipsecurity client_ip
| where security.is_tor=true
| eval alert_message="Tor login attempt from " . client_ip
| table _time, user, client_ip, alert_message

Score incoming webhook requests by threat level:

index=api_gateway path="/webhook/payment"
| rex field=_raw "\"x-forwarded-for\":\"(?<req_ip>[^\"]+)\""
| ipsecurity req_ip
| where security.threat_score > 70
| table _time, req_ip, security.threat_score, security.is_bot, security.is_spam

4. ipsecuritybatch Command

Type: GeneratingSupported Methods: API (PAID only)Min. Plan: PAID

The ipsecuritybatch command lets you look up security information for a static list of IPs. Like ipgeolocationbatch , it is a generating command (starts with | ).

Syntax:

| ipsecuritybatch ips="<ip1>,<ip2>,..."

Examples:

Check a batch of IPs from a threat intelligence feed:

| ipsecuritybatch ips="91.108.4.1, 185.220.101.45, 176.10.99.200, 194.165.16.87"
| table ip, security.is_vpn, security.is_proxy, security.is_tor, security.is_bot, security.threat_score
| sort -security.threat_score

Weekly automated threat scoring of your top talkers:

index=firewall earliest=-7d@d
| top limit=50 src_ip
| rename src_ip as ip
| table ip
| map search="| ipsecuritybatch ips=\"$ip$\""
| where security.threat_score > 50
| outputlookup high_risk_ips.csv

1. Standard Databases

2. Advanced Databases

3. Security Pro Databases