topic Re: iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/ in Splunk Search

iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/

rahulkumarfgf — Wed, 30 Sep 2020 04:25:36 GMT

Hello Eveyone,
I am trying to use iplocation command to search for ip address info within my network. My search is as below:
eventtype=wineventlog_security
| iplocation src_ip prefix=srcip_
| table src_ip, City, Country

I am getting the IP list with other columns blank. I did some research and found iplocation.py is not present in the above directory. I do have GeoLite2-City.mmdb and iso3166 files in "$SPLUNK_HOME/share/" directory. I am wondering if the missing .py file is the reason for my issue. If so, how can I resolve it?

Any help would be much appreciated. Thank You!

Re: iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/

rahulkumarfgf — Thu, 27 Feb 2020 16:21:45 GMT

Update: I was on version 8.0.1 and upgraded it to 8.0.2, however, still can't find iplocation.py file.

Re: iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/

sumanssah — Thu, 27 Feb 2020 16:26:18 GMT

Just to apprise iplocation command will not work with the internal/intranet environment (unless you have not specified your internal IP geo-location explicitly in Splunk.

Try with external/internet address/host

Example

| makeresults 
| eval src_ip="8.8.8.8"
| iplocation src_ip prefix=srcip_

Re: iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/

rahulkumarfgf — Thu, 27 Feb 2020 16:31:06 GMT

Thank you @sumanssah !

That helped. Will try and add the IP's and check if that works. Thank you!

Re: iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/

sumanssah — Thu, 27 Feb 2020 16:33:04 GMT

you're welcome 🙂

Re: iplocation.py file missing from $SPLUNK_HOME/etc/apps/search/bin/

rahulkumarfgf — Thu, 27 Feb 2020 16:42:58 GMT

I would like to know if iplocation.py file has been deprecated with the newer version since I was looking at this link
https://answers.splunk.com/answers/37249/specifying-field-w-iplocation.html
and thought it would be helpful to look at the code and make some changes as per requirement. However, I am not able to find the file.