topic Re: When will Splunk upgrade iplocation database in Installation

When will Splunk upgrade iplocation database?

cahuang — Tue, 16 Jun 2020 23:32:33 GMT

Hi Splunk,

Which Iplocation database does Splunk use? Is it Maxmind? We find that the iplocation database which we are using is not the latest one. Does splunk team have any plan to upgrade? Or can our team upgrade on our own?

Thanks!

Re: When will Splunk upgrade iplocation database

richgalloway — Tue, 17 Jan 2017 13:32:00 GMT

Yes, Splunk uses the Maxmind iplocation database. The database is supposed to be updated with every new release of Splunk. Of course, that could mean waiting months for a location correction.

It is possible to update the database yourself. If you do that, however, Splunk will complain about an invalid file. If you can live with that, then check out https://answers.splunk.com/answers/123430/how-to-update-geoip-database-for-iplocation-command.html.

Re: When will Splunk upgrade iplocation database

cahuang — Fri, 20 Jan 2017 04:47:50 GMT

Thanks. could you let me know when is next release? Generally when is your release date? Is it in regular plan?

Re: When will Splunk upgrade iplocation database

richgalloway — Fri, 20 Jan 2017 13:11:30 GMT

I'm not a Splunker so I don't have access to the release schedule, but observation shows new version tend to come out every two months or so.

Re: When will Splunk upgrade iplocation database

dgoodwin1 — Thu, 16 Mar 2017 20:32:11 GMT

My last loc db update came with patching to 6.3.8. I notice I am no longer getting city name back on a lot of IP addresses so I tried the latest Maxmind db free dl. That new file seems to not work at all with 6.3.8. No results from iplocation not even country. I revert to the old version and I am back in business. Anyone know whats going on?
,I just tried pulling down the latest version from Maxmind and after updating iplocation no longer pulls back any data. Switching back to the old version of the db gets me working again. There is a note on the Maxmind dl page that they updated the format of the file. Is it possible my installation can not longer read the mmdb format? My last update came with patching to
6.3.8.