Ip location return a wrong location after update db

saveriobocca — Fri, 20 Mar 2020 00:49:25 GMT

Hi all,
I have Splunk ESS Version: 7.1.3.

After updating the GeoLite2-City.mmdb db (last 17/3/20) I noticed that in my query the location is still wrong.

Example:

index=network eventtype=cisco_vpn_start "AnyConnect parent session started." 
| where src_ip ="37.161.xx.xxx"
| iplocation src_ip 
| table src_ip, Country

src_ip  Country
37.161.xx.xxx   France

However when I running the following command:

| makeresults 
| eval ip="37.161.xx.xxx" 
| iplocation ip
| table Country, ip

Country   ip
Italy       37.161.xx.xxx

Why in one case is the correct value returned to me (Italy) while in the first case France appears to me?
The behavior is very anomalous to me 😞

Do you have any suggestion or fix for first query?

Thanks a lot,
Saverio

topic Ip location return a wrong location after update db in Splunk Enterprise Security

Ip location return a wrong location after update db