App for SplunkFour SPL commands add geolocation, ASN, VPN and proxy detection, and threat scores to your events. Free to start.
Splunk's built-in iplocation command gives you basic IP geolocation, the country and city behind an address. It cannot tell you whether that address is a VPN, a proxy, a Tor exit, or a known attacker, who owns the network, or where to report abuse.
The ipgeolocation.io App for Splunk adds that context to every event: city-level location, ASN and network owner, VPN, proxy, residential proxy, and Tor detection, a 0 to 100 threat score, and abuse contacts. A blocked-traffic row that read United States now shows Clouvider hosting, proxy, threat score 80. Location comes from the IP Geolocation API, threat signals from the IP Security data.
index=firewall action=blocked
| ipgeolocation src_ip
| table src_ip, country, is_proxy, threat_score+---------------+-----------+----------+------------+ | src_ip | country | is_proxy | threat_score | +---------------+---------+----------+--------------+ | 45.83.x.x | US | true | 80 | +---------------+---------+----------+--------------+
Pipe any field holding an IPv4 or IPv6 address through these four commands. No scripting.
ipgeolocation Enrich a live search with location, ASN, timezone, and optional security data as results stream through.
index=web
| ipgeolocation ip_field=clientipipgeolocationbatch Profile a static list of IPs from a threat feed or lookup, with no source search needed.
| inputlookup threat_feed.csv
| ipgeolocationbatch ip_field=indicatoripsecurity Pull just the security signals, VPN, proxy, Tor, bot, and threat score, without the full geo payload.
index=okta eventType=login
| ipsecurity src_ipipsecuritybatch Score a batch of suspect IPs from an intel feed, then route the risky ones onward.
| inputlookup suspect_ips.csv
| ipsecuritybatch ip_field=ip
| where threat_score > 60Full syntax lives in the Splunk app documentation.
The same commands run two ways, set in the app's setup screen: choose by volume and how far your search heads may reach out.
Real-time lookups over HTTPS, freshest data, large lists batched automatically. Best for investigation and moderate volume.
Local MaxMind-format files, no external call per search, sub-millisecond per-IP lookups, refreshed on your schedule. Best for air-gapped or high-volume pipelines.
The downloadable databases install into the app's own lookups directory, without overwriting Splunk's default MMDB. See database plans for options.
From impossible-travel detection to IOC enrichment, see how security teams enrich IPs in SPL.
Join geolocation to your auth logs and flag two successful logins from different countries within an hour, the classic account-takeover signal.
Join geolocation to your auth logs and flag two successful logins from different countries within an hour, the classic account-takeover signal.
Surface Okta and SSO logins arriving through VPNs, proxies, or Tor exit nodes, then rank users by how often they hide their origin.
Take a list of indicator IPs from a threat feed and attach country, ASN owner, threat score, and abuse contact in one command.
Score inbound webhook and checkout traffic by threat score and proxy flags, then keep only the requests above your risk line.
Map blocked firewall traffic by country onto a Splunk cluster map, or catch access from outside your allowed regions during a review.
Backed by an API: sub-40ms average response, 99.99% uptime SLA.
Add the ipgeolocation.io App for Splunk from Splunkbase to your Enterprise or Cloud deployment.
Add your API key, or a database key for MMDB mode, on the app's setup screen.
Pipe any IP field through the ipgeolocation command and keep the enriched columns you need.
Add the ipgeolocation.io App for Splunk from Splunkbase to your Enterprise or Cloud deployment.
Install the app, add your key, enrich a searchAdd your API key, or a database key for MMDB mode, on the app's setup screen.
Pipe any IP field through the ipgeolocation command and keep the enriched columns you need.
The setup guide covers distributed and search head cluster deployments. Related: the Steampipe, Maltego, and Elasticsearch integrations.
Splunk's built-in iplocation command stops at country and city. The ipgeolocation.io App adds the network owner, VPN and proxy detection, a 0 to 100 threat score, and abuse contacts to every event, from the API or a local database, all in the SPL you already write.
City-level location plus ASN and network owner, VPN, proxy, residential proxy, and Tor detection, a threat score, and abuse contacts, on every enriched row.
Pipe any IPv4 or IPv6 field through streaming or generating commands. No scripting, no external app to stand up first.
Run real-time lookups over HTTPS, or read local MaxMind-format databases inside Splunk for air-gapped and high-volume pipelines.
The geolocation commands run on the free plan, no card required. Security data unlocks on paid plans.
The iplocation command returns country, city, and coordinates from a bundled database. This app adds the network owner (ASN and company), VPN, proxy, residential proxy, and Tor detection, a 0 to 100 threat score, and abuse contacts, live from the API or a local database.
Yes. MMDB mode reads local MaxMind-format database files inside Splunk, so no lookup leaves your environment and each per-IP lookup is sub-millisecond. The app refreshes the databases on the schedule you set, which suits air-gapped and high-volume deployments.
The free plan runs the geolocation commands, ipgeolocation and ipgeolocationbatch , with no card required. VPN, proxy, Tor, and threat-score data need a paid plan. See plans and credits and how credits are counted.
Both. The security data returns VPN, proxy, residential proxy, Tor, relay, bot, spam, known-attacker, and cloud-provider flags, each with provider names and confidence where known, plus a 0 to 100 threat score. Security data requires a paid plan; basic geolocation does not.
Splunk Enterprise and Splunk Cloud, across Splunk 9.x and 10.x. The Splunkbase listing shows support through Splunk 10.5; check it for the current list. Python 3.13 or later is recommended, and the app is CIM 8.x compatible.
Unlock the potential of seamless connectivity with our integrations. Discover how our platform effortlessly connects with your favorite tools, third-party platforms, and developer libraries. Simplify your workflow, boost productivity, and open doors to new innovations.
Get the latest in geolocation tech, straight to your inbox.
