https://community.splunk.com/t5/Splunk-Enterprise-Security/Longitude-in-DA-ESS-ThreatIntelligence-is-named-as-long-but-the/m-p/422487#M5281 <P>The following Bug had been logged with Product Management to clarify whether it was a Bug.</P> <P><STRONG>SOLNESS-19368</STRONG> iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security</P> <P>The response from Product Management (who confirmed it is not a Bug) is below:</P> <P>CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon".<BR /> So the discrepancy itself is expected, we just missed the conditional eval component to align things properly.</P> Wed, 31 Jul 2019 14:09:21 GMT christopherr_sp 2019-07-31T14:09:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Longitude-in-DA-ESS-ThreatIntelligence-is-named-as-long-but-the/m-p/422486#M5280 <P>There is a BUG in the DA-ESS-ThreatIntelligence app. </P> <P>In the Datamodel under <EM>Threat Intelligence &gt; IP Intelligence</EM> there is a field named “long” this field is supposed to hold the longitude of the IP address in the “ip” field.</P> <P>Given the base search the field should be called “lon” because that is the field that the “iplocation” command outputs OR a rename should be done in the search to rename “lon” to “long”.</P> <P>The problem found in DA-ESS-ThreatIntelligence 4.5.0 and above (all versions including the latest).</P> Wed, 31 Jul 2019 14:07:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Longitude-in-DA-ESS-ThreatIntelligence-is-named-as-long-but-the/m-p/422486#M5280 christopherr_sp 2019-07-31T14:07:41Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Longitude-in-DA-ESS-ThreatIntelligence-is-named-as-long-but-the/m-p/422487#M5281 <P>The following Bug had been logged with Product Management to clarify whether it was a Bug.</P> <P><STRONG>SOLNESS-19368</STRONG> iplocation has a field called 'lon' in Splunk and 'long' in Enterprise Security</P> <P>The response from Product Management (who confirmed it is not a Bug) is below:</P> <P>CIM uses "long", but Splunk Enterprise's geo-location search command outputs "lon".<BR /> So the discrepancy itself is expected, we just missed the conditional eval component to align things properly.</P> Wed, 31 Jul 2019 14:09:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Longitude-in-DA-ESS-ThreatIntelligence-is-named-as-long-but-the/m-p/422487#M5281 christopherr_sp 2019-07-31T14:09:21Z