https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-is-gia-summary-index-not-populating/m-p/586102#M10629 <P>Just an update in case anyone in the future has this problem.</P><P>I had pull a list of all assets with CIDR information, and then create a lookup for CIDR.</P><P>I also populated the data with city, country, lat, long. That seemed to fix it!</P> Tue, 22 Feb 2022 19:27:59 GMT Stefanie 2022-02-22T19:27:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-is-gia-summary-index-not-populating/m-p/579797#M10520 <P data-unlink="true">I've been investigating why I started to not receive&nbsp; ES events for some time now. After upgrading ES, I had to reinstall a lot of the apps that were previously installed &amp; configured. One of the things I have not been able to resolve is how to get ES to detect "Geographically Improbable Access Detected"&nbsp;again.&nbsp;</P> <P data-unlink="true">My Authentication Datamodel is receiving events again.&nbsp;</P> <P data-unlink="true">My asset_lookup_by_str has events</P> <P data-unlink="true">However, my asset_lookup_by_cidr does not return results. So I believe this may be causing it.</P> <P data-unlink="true">How can I get the asset_lookup_by_cidr to populate again?</P> Tue, 22 Feb 2022 21:27:04 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-is-gia-summary-index-not-populating/m-p/579797#M10520 Stefanie 2022-02-22T21:27:04Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-is-gia-summary-index-not-populating/m-p/586102#M10629 <P>Just an update in case anyone in the future has this problem.</P><P>I had pull a list of all assets with CIDR information, and then create a lookup for CIDR.</P><P>I also populated the data with city, country, lat, long. That seemed to fix it!</P> Tue, 22 Feb 2022 19:27:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-is-gia-summary-index-not-populating/m-p/586102#M10629 Stefanie 2022-02-22T19:27:59Z