https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508172#M142006 <P>Hello,&nbsp;</P> <P>I am trying to use iplocation to search for instances of a specific city or region for example:&nbsp;</P> <LI-CODE lang="markup">* iplocation ipaddress Region="region" </LI-CODE> <P>Instead of returning that specific region it will return all regions. Can anyone tell me if this is a bug or am I missing something?&nbsp;</P> <P>Thanks&nbsp;</P> Wed, 08 Jul 2020 22:25:50 GMT mgp173455 2020-07-08T22:25:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508172#M142006 <P>Hello,&nbsp;</P> <P>I am trying to use iplocation to search for instances of a specific city or region for example:&nbsp;</P> <LI-CODE lang="markup">* iplocation ipaddress Region="region" </LI-CODE> <P>Instead of returning that specific region it will return all regions. Can anyone tell me if this is a bug or am I missing something?&nbsp;</P> <P>Thanks&nbsp;</P> Wed, 08 Jul 2020 22:25:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508172#M142006 mgp173455 2020-07-08T22:25:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508179#M142009 <P>The iplocation command does not have a <FONT face="courier new,courier">region</FONT> option.</P><LI-CODE lang="markup">iplocation [prefix=&lt;string&gt;] [allfields=&lt;bool&gt;] [lang=&lt;string&gt;] &lt;ip-address-fieldname&gt;</LI-CODE><P>See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Iplocation" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Iplocation</A>&nbsp;</P> Wed, 08 Jul 2020 20:44:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508179#M142009 richgalloway 2020-07-08T20:44:31Z https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508186#M142011 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2DA9842C-92D5-4E27-B93D-4E3BD694D3B9.png" style="width: 750px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9569i0D56032696D58073/image-size/medium?v=v2&amp;px=400" role="button" title="2DA9842C-92D5-4E27-B93D-4E3BD694D3B9.png" alt="2DA9842C-92D5-4E27-B93D-4E3BD694D3B9.png" /></span></P><P> </P><P>Hi thank you for your reply!&nbsp;<BR /><BR /></P><P>Ahh I see. From my understanding &nbsp;the documentation displays a region field with a prefix iploc_ to help distinguish from other fields that might already be present with the same name.&nbsp;<BR /><BR /></P><P>In my case I don’t have a previous region field so I don’t use the prefix query. Could you provide more insight as to why a prefixed field might be displayed if not supported? (i.e. I have tried doing this with iploc_Region as well)&nbsp;</P><P>&nbsp;</P><P>Any help is much appreciated!</P> Wed, 08 Jul 2020 21:14:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508186#M142011 mgp173455 2020-07-08T21:14:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508209#M142019 Region/iploc_region are *output* fields, not input fields. They're part of the results, not part of the command. Thu, 09 Jul 2020 00:08:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-iplocation-to-search-for-instances-of-a-specific-city/m-p/508209#M142019 richgalloway 2020-07-09T00:08:45Z