topic Why is iplocation showing incorrect data ? in Splunk Search

Why is iplocation showing incorrect data ?

zacksoft_wf — Wed, 20 Apr 2022 14:44:58 GMT

In my ES App, I have a rule where I noted some discrepancy regarding the source country for the src ip 112.196.162.127.

Using 'iplocation' command in SPL it shows as Turkey.
But in whoisdomaintools it shows as India.
112.196.162.127 IP Address Whois | DomainTools.com

Any suggestion why this is the case ?

Re: iplocation showing incorrect data !!

richgalloway — Wed, 20 Apr 2022 13:06:03 GMT

It's possible the MaxMind database (source for the iplocation command) is outdated. What version of Splunk are you using? Have you tried updating the database (see https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file for instructions)?

Re: iplocation showing incorrect data !!

zacksoft_wf — Wed, 20 Apr 2022 13:47:13 GMT

I noticed something,
In my query if I write like this I get wrong iplocation data

index=palo_alto_networks TERM(112.196.162.127)
| table _time, sourcetype, src, local_ip Country user_name
| iplocation src

But if, I change the iplocation comands position to the middle , it gives the correct country data
like this

index=palo_alto_networks TERM(112.196.162.127)
| iplocation src
| table _time, sourcetype, src, local_ip Country user_name

Re: iplocation showing incorrect data !!

richgalloway — Wed, 20 Apr 2022 14:50:42 GMT

The first query tries to display the Country field before iplocation has created it, so it's no surprise it doesn't show expected results.