The Scenario
You're a security analyst. It's Wednesday afternoon and the SIEM import is scheduled for Thursday morning. On your screen: a Google Sheet with 800 unique IP addresses pulled from last week's server access logs. Each one needs country, region, city, and ASN before you can upload the enriched file.
The bad version:
- Open IPinfo's web UI, paste the first IP, copy country, switch tabs, paste into column B, repeat for region, city, ASN — then advance to row 2.
- After 30 minutes you've done 22 rows. The import window is in 16 hours.
- You export to CSV, write a Python script to call the API, realize you haven't handled the rate limit, fix the script, re-run it, then spend 20 minutes reformatting the output to match the sheet's column order.
Scripting this isn't what you were hired to do — you were supposed to be reviewing the access patterns, not building a data pipeline. The 800-row enrichment job is blocking the actual analysis.
The Easy Way: One Prompt in SheetXAI
SheetXAI is an AI agent inside your Google Sheet. It reads the data you're looking at and, through its built-in IPinfo integration, can call the batch lookup API, write results to your columns, and apply conditional logic — all from a single instruction.
Open the SheetXAI sidebar and paste this prompt:
Look up all IP addresses in column A using IPinfo batch lookup and write country, region, city, and ASN to columns B through E. Flag any row where the country is outside the US, UK, or Canada as "Review" in column F.
What You Get
- Column B: two-letter country code (US, DE, IN, etc.) for every row
- Column C: region or state name
- Column D: city
- Column E: ASN in the format "AS15169 Google LLC"
- Column F: "Review" for any IP outside the allowed countries; blank for rows that pass
- Rows where IPinfo returns no data are written as empty cells, not errors
What If the Data Is Not Quite Ready
IPs are mixed in with other log fields in column A
The entries in column A contain timestamps and IP addresses in the format "2024-03-12T14:22:01Z 192.168.1.1". Extract the IP from each row using the space as a delimiter, look up each IP with IPinfo batch lookup, and write country, region, city, and ASN to columns B through E.
Some rows in column A are private or reserved IPs (10.x.x.x, 192.168.x.x)
Look up all IPs in column A with IPinfo and write country, region, city, and ASN to columns B through E. Skip any row where the IP starts with 10., 172.16-31., or 192.168. and write "Private" in column B for those rows instead.
The same IP appears in multiple rows and I want to deduplicate before lookup
Find all unique IP addresses in column A, look them up in bulk with IPinfo, write the results to a new tab called "IP Lookup Cache" with columns A through E for IP, country, region, city, ASN — then VLOOKUP back into the main sheet to fill columns B through E for each row based on the IP in column A.
Full cleanup, enrichment, and flag in one shot
Column A has raw log entries mixing IPs, timestamps, and user agents separated by pipes. Extract the IP address from each row, skip private and reserved ranges, deduplicate for the API call, look up country, region, city, and ASN via IPinfo batch lookup, write results to columns B through E using the deduplication cache, and mark column F "Review" for any non-US/UK/CA IP or any row where IPinfo returned no data.
The pattern: prep and enrichment in one instruction, so the cleaned data and the API results land together.
Try It
Get the 7-day free trial of SheetXAI and open any Google Sheet with a column of raw IP addresses from your access logs or SIEM export, then ask it to enrich and flag them with IPinfo. For related tasks, see how to build a geographic traffic report or screen sign-ups for VPN flags. The full overview is at the IPinfo + Google Sheets hub.