In Splunk, a workflow action that returns an external IP lookup for a field named domain would typically use the GET method. This HTTP method is used to retrieve data from a specified resource, which is appropriate for looking up information based on the domain field.
References:
Splunk Docs: Define workflow actions
Splunk Answers: Workflow actions for external lookups

The regular expression mode of Field Extractor (FX) should be used for data with multiple, different characters separating fields or for unstructured data. The regular expression mode allows you to select a sample event and highlight the fields that you want to extract, and the field extractor generates a regular expression that matches similar events and extracts the fields from them.ReferencesSee Build field extractions with the field extractor - Splunk Documentation and Field Extractor: Select Method step - Splunk Documentation.

Tags are a knowledge object that allow you to assign an alias to one or more field values . Tags are applied to events at search time and can be used as search terms or filters .
Tags can help you make your data more understandable by replacing cryptic or complex field values with meaningful names . For example, you can tag the value 200 in the status field as success, or tag the value 404 as not_found .

https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/SetupaGETworkflowaction Define a GET workflow action Steps Navigate to Settings > Fields > Workflow Actions.
Click New to open up a new workflow action form.
Define a Label for the action.
The Label field enables you to define the text that is displayed in either the field or event workflow menu.
Labels can be static or include the value of relevant fields.
Determine whether the workflow action applies to specific fields or event types in your data.
Use Apply only to the following fields to identify one or more fields. When you identify fields, the workflow action only appears for events that have those fields, either in their event menu or field menus. If you leave it blank or enter an asterisk the action appears in menus for all fields.
Use Apply only to the following event types to identify one or more event types. If you identify an event type, the workflow action only appears in the event menus for events that belong to the event type.
For Show action in determine whether you want the action to appear in the Event menu, the Fields menus, or Both.
Set Action type to link.
In URI provide a URI for the location of the external resource that you want to send your field values to.
Similar to the Label setting, when you declare the value of a field, you use the name of the field enclosed by dollar signs.
Variables passed in GET actions via URIs are automatically URL encoded during transmission. This means you can include values that have spaces between words or punctuation characters.
Under Open link in, determine whether the workflow action displays in the current window or if it opens the link in a new window.
Set the Link method to get.
Click Save to save your workflow action definition.

Splunk ships with the following KMZ files for choropleth maps: States of the United States and Countries of the World. A KMZ file is a compressed file that contains a KML file and other resources. A KML file is an XML file that defines geographic features and their properties. A KMZ file can be used to create choropleth maps in Splunk by using the geom command. A choropleth map is a type of map that shows geographic regions with different colors based on some metric. Splunk ships with two KMZ files that define the geographic regions for choropleth maps:
States of the United States: This KMZ file defines the 50 states of the United States and their boundaries. The name of this KMZ file is us_states.kmz and it is located in the $SPLUNK_HOME/etc/apps/maps/appserver
/static/geo directory.
Countries of the World: This KMZ file defines the countries of the world and their boundaries. The name of this KMZ file is world_countries.kmz and it is located in the $SPLUNK_HOME/etc/apps/maps/appserver
/static/geo directory.
Splunk does not ship with KMZ files for States and provinces of the United States and Canada or Countries of the European Union. However, you can create your own KMZ files or download them from external sources and use them in Splunk.