- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
splunk - import IPAM networks for lookup
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
10-02-2017 07:17 AM
https://gist.github.com/pmeyerson/d68361c8258378c29e7848997c42af4e
Might be a bit cludgy because I am still learning python and shell scripting.
Biggest gotchas were to enable API access on the infoblox user's group settings, and make sure the lookup permissions were global on the splunk side.
HTH
Re: splunk - import IPAM networks for lookup
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
10-04-2017 02:11 PM
Thanks for this, nice work!
Re: splunk - import IPAM networks for lookup
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
12-21-2017 01:03 PM
I would now reccomend using the Splunk add-on https://splunkbase.splunk.com/app/1546/ (rest_ta). You can then run a saved search to take the latest results and | outputlookup to update your lookup with latest data.
I ended up using response handler: JSONArrayHandler
If you want to specify arguments that are multi-value, be sure to change the delimiter to ":"
Re: splunk - import IPAM networks for lookup
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
01-09-2018 11:36 AM
We have splunk here as well. Not sure what this really does. Can you give an example please? Great work on the code.
Re: splunk - import IPAM networks for lookup
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
01-09-2018 05:01 PM
JS,
I get a csv/splunk lookup like this:
192.168.1.0\24, DataCenter1, servers
192.168.50.0\24, SiteC, workstations
192.168.55.0\26, SiteD, Guest Wifi
etc...
or whatever data you decide to put in the description field in infoblox for your networks.
For working with splunk I would look at the modular input app to eliminate the need for the python code. You can then use a scheduled search and | outputlookup to save as a lookup csv.
HTH