https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309953#M37091 <P><STRONG>and do those events have the fields "lat" and "lon" that you specified for geostats?</STRONG></P> Tue, 11 Jul 2017 20:27:02 GMT s2_splunk 2017-07-11T20:27:02Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309946#M37084 <P>Can I use iplocation with an ip address I get from a dbxquery? </P> Tue, 11 Jul 2017 18:39:14 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309946#M37084 jhdietz 2017-07-11T18:39:14Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309947#M37085 <P>Yes. As long as you have a field that contains an ip address, I see no reason why we care where it came from. </P> Tue, 11 Jul 2017 18:49:29 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309947#M37085 s2_splunk 2017-07-11T18:49:29Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309948#M37086 <P>iplocation does work by itself but not with geostats</P> Tue, 11 Jul 2017 19:14:10 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309948#M37086 jhdietz 2017-07-11T19:14:10Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309949#M37087 <P>Share your search example and/or screenshot?<BR /> Do you have latitude/longitude fields in your events after using iplocation?</P> Tue, 11 Jul 2017 19:23:00 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309949#M37087 s2_splunk 2017-07-11T19:23:00Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309950#M37088 <P>I don't have the lat/lon fields in my events and I can't attach a screenshot so here is my search:</P> <P>|dbxquery connection=db.connection query="select remoteaddr from table" shortnames = t<BR /> |iplocation = remotaddr<BR /> |geostats latfield=lat longfield=lon globallimit=0</P> <P>No results found.</P> Tue, 11 Jul 2017 19:52:10 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309950#M37088 jhdietz 2017-07-11T19:52:10Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309951#M37089 <P>Do you get any events without specifying the | geostats command and do those events have the fields "lat" and "lon" that you specified for geostats?</P> Tue, 11 Jul 2017 20:05:20 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309951#M37089 s2_splunk 2017-07-11T20:05:20Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309952#M37090 <P>I get stats without specifying the geostats command</P> Tue, 11 Jul 2017 20:08:05 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309952#M37090 jhdietz 2017-07-11T20:08:05Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309953#M37091 <P><STRONG>and do those events have the fields "lat" and "lon" that you specified for geostats?</STRONG></P> Tue, 11 Jul 2017 20:27:02 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309953#M37091 s2_splunk 2017-07-11T20:27:02Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309954#M37092 <P>Looking at your search again, I see that you have multiple typos in there.<BR /> It should be <STRONG>| iplocation remoteaddr</STRONG> instead of <STRONG>|iplocation = remotaddr</STRONG> (no equals sign and properly spelled field name).</P> <P>I just tried this and it works just fine:</P> <PRE><CODE>| makeresults | eval remoteaddr="50.26.126.246" | iplocation remoteaddr | geostats latfield=lat longfield=lon </CODE></PRE> <P>Please ensure you are using the correct syntax and try again.</P> Tue, 11 Jul 2017 20:34:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309954#M37092 s2_splunk 2017-07-11T20:34:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309955#M37093 <P>Can you test using dbxquery? I get the same results with the "iplocation remoteaddr" syntax. I get nearly 12k worth of stats but no latitude or longitude when I add "| geostats latfield=lat longfield=lon"</P> Wed, 12 Jul 2017 11:16:33 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309955#M37093 jhdietz 2017-07-12T11:16:33Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309956#M37094 <P>I got this working, the remoteaddr field is case sensitive so it worked after I use REMOTEADDR</P> Wed, 12 Jul 2017 15:46:46 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309956#M37094 jhdietz 2017-07-12T15:46:46Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309957#M37095 <P><span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> <BR /> Thanks for providing the update!</P> <P>Yes, all Splunk field names are case-sensitive, field values are not.</P> <P>BTW, geostats does not create latitude and longitude, it requires it as input args. Which is why you should see a lat and long field after running iplocation successfully.</P> Wed, 12 Jul 2017 23:01:12 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-I-use-iplocation-with-an-ip-address-I-get-from-a-dbxquery/m-p/309957#M37095 s2_splunk 2017-07-12T23:01:12Z