https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482875#M135237 <P>Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.</P> Wed, 26 Feb 2020 12:29:41 GMT mbraiman 2020-02-26T12:29:41Z https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482872#M135234 <P>Good Afternoon everyone!</P> <P>We seem to be encountering a discrepancy with our IPLocation database. We're running Splunk 7.3.3 and recently updated the GeoLite lookup in /opt/splunk/share. We noticed a discrepancy however between what the MaxMind's mmdb file returns and what other online IP lookups show. The IP in question shows as a London/U.K based IP in online engines (including MaxMind's own lookup.) However Splunk's iplocation function labels it as an Italy-based address with appropriate Lat/Lon values. I'm at a loss as to what'd be causing this apparent mismatch. Any insight/experiences as to what's causing this problem are appreciated!</P> Tue, 25 Feb 2020 18:39:41 GMT https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482872#M135234 mbraiman 2020-02-25T18:39:41Z https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482873#M135235 <P>Hi mbraiman, </P> <P>Please provide some sample events that will result in the wrong location as well as the <STRONG>complete</STRONG> SPL used on these events, and the version of the MaxMind's mmdb file you used.</P> <P>cheers, MuS</P> Tue, 25 Feb 2020 20:30:34 GMT https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482873#M135235 MuS 2020-02-25T20:30:34Z https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482874#M135236 <P>Thanks for the reply MuS - I didn't realize that the mmdb file needed to be updated on each of our indexers as well as the search head. Once that was done the iplocation function mapped the events as we expected them. Thanks for your reply!</P> Wed, 26 Feb 2020 12:29:07 GMT https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482874#M135236 mbraiman 2020-02-26T12:29:07Z https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482875#M135237 <P>Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results.</P> Wed, 26 Feb 2020 12:29:41 GMT https://community.splunk.com/t5/Splunk-Search/GeoLite-IPLocation-discrepancy/m-p/482875#M135237 mbraiman 2020-02-26T12:29:41Z