topic Re: iplocation command usage in Splunk Enterprise

iplocation command usage

rayar — Thu, 08 Apr 2021 12:11:24 GMT

we are using iplocation command

i see that the GeoLite2-City.mmdb file is since 2019

[splunk@ilissplsh01 bin]$ ll /opt/splunk/share/GeoLite2-City.mmdb
-r--r--r-- 1 splunk splunk 60695934 Dec 18 2019 /opt/splunk/share/GeoLite2-City.mmdb
[splunk@ilissplsh01 bin]$

I have downloaded the file from https://www.maxmind.com/en/accounts/532070/geoip/downloads

also I see that there is Geolocation Lookup for Splunk APP (https://splunkbase.splunk.com/app/4102/#/overview) to allow iplocation

what is the recommended way to work with the command ?

thanks

Re: iplocation command usage

96nick — Thu, 08 Apr 2021 13:08:31 GMT

If you're talking about just updating the file, you're on the right track. Do you have a distributed environment or a single instance?

Single Instance:

You can download the 'Auto Update Maxmind Database' app on Splunkbase. It creates a Splunk command that downloads the newest DB for you after you put in your license key. Works well enough if you have a single instance.

Distributed Environment:

If you have indexers, search heads, etc. you will have to replace the mmdb file on your indexers as well. This is because iplocation is a distributable streaming command. The app I listed above won't do that, and it also doesn't easily support using a paid database from Maxmind if you choose to upgrade. In my environment I created an app that has a bash script, the database, and limits.conf. The bash script wgets the database (scheduled via cron), and limits.conf changes the location of the database to my app. You can view more information on that process here in a Splunk Blog post.

Hope that helped!

Re: iplocation command usage

rayar — Thu, 08 Apr 2021 14:06:53 GMT

thanks a lot

we have a distributed env and we are using deployment server

can't I distribute the file using it ?

Re: iplocation command usage

96nick — Thu, 08 Apr 2021 15:08:55 GMT

You can distribute the app with the deployer (the SH kind, not the deployment server that connects with your forwarders) if you have a search head cluster. If you only have 1 search head then you wouldn't have a deployer.

You'll have to set up a cron on the SHs manually (or by using a system management tool if you have one to set the cron) to pull down the database, something like:

# Gets the database from maxmind at 7am every Wednesday

0 7 * * * 3 /opt/splunk/.../<your app>/bin/getdatabase.sh

Maxmind updates the database on Tuesday, so I would pull the database down on Wednesday since it's unknown exactly when on Tuesday they push an update.

Since you have indexers you'll have to replace those mmdb files as well. The same concept can be applied to the indexers (some script + cron).

Re: iplocation command usage

rayar — Mon, 12 Apr 2021 05:52:13 GMT

I have installed the Auto Update MaxMind Database on the SH (https://splunkbase.splunk.com/app/5482/#/details)

the GeoLite2-City.mmdb file will be copied to deployment server and deployed to all indexers

also I will create limits.conf on both SH and indexers with the below

splunk@ilisspldepl01 local]$ cat limits.conf
[iplocation]
db_path = /opt/splunk/etc/slave-apps/AM_maxmind_indexers/local/GeoLite2-City.mmdb
[splunk@ilisspldepl01 local]$

is it the right way or I better overwrite the /opt/splunk/share/GeoLite2-City.mmdb on the indexers and the SH ?

Re: iplocation command usage

96nick — Mon, 12 Apr 2021 12:57:23 GMT

Yeah, just a couple things:

The limits.conf will have to be different between the SHs and the Indexers since the indexers will have the app with limits.conf in ../etc/slave-apps while the search head will have it in .../etc/apps (assuming you dont have a search head cluster)
Also make sure you remove/rename the limits.conf file in /opt/splunk/etc/system/local if present.
You can also include a script in your app you deploy to auto-update the DB on your indexers. You may have to set up a cron to run it though.

Hope that helped!

Re: iplocation command usage

rayar — Mon, 12 Apr 2021 13:02:11 GMT

The limits.conf are different on indexers and SH

we don't have /opt/splunk/etc/system/local/limits.conf

the updated file will be copied with cron to the deployment server

thanks a lot , will test it during the week