topic Why is iplocation command returning wrong countries? in Splunk Search

Why is iplocation command returning wrong countries?

juancamiloll — Wed, 01 Jun 2022 19:09:52 GMT

Hi everyone

I am currently getting logs from microsoft 365 and one of its panels shows the impossible simultaneous locations.

When I check the IP with any page for whois like virustotal or abuseipdb, for example, from Sweden, I find that it really is from another country.

Is there something wrong with the iplocation command or something I need to adjust

How can it be solved?

Re: Why is iplocation command returning wrong countries?

richgalloway — Thu, 02 Jun 2022 00:32:33 GMT

The iplocation command uses a database from MaxMind. That database is only updated when you install a new version of Splunk, unless you take specific steps to update it yourself. Depending on the version of Splunk you are using the location database could be very old and outdated.

Re: Why is iplocation command returning wrong countries?

PickleRick — Thu, 02 Jun 2022 04:58:53 GMT

You have to remember also that all those ip-geo databases are best-effort only. There is no way to determine a 100% sure location of a given IP. They are usually pretty ok, but sometimes the results can be non-reliable.

Re: Why is iplocation command returning wrong countries?

VatsalJagani — Thu, 02 Jun 2022 05:08:33 GMT

@juancamiloll - As mentioned by @richgalloway it uses the MaxMind database to find the IP location. The MaxMind database is not auto-updated, you need to do it manually or you can use App like https://splunkbase.splunk.com/app/5482/ (Auto Update MaxMind Database) to update it regularly.

As mentioned by @PickleRick , even though you update the MaxMind database regularly there is no guarantee that it will tell you the exact and correct location. Different IP location database generates different results sometimes.

I hope this helps!!!!

Re: Why is iplocation command returning wrong countries?

juancamiloll — Sun, 05 Jun 2022 23:58:06 GMT

Thank you very much for your help.

I followed the steps downloading the file, then unzipping it and moving it to the /splunk/share folder

I restarted splunk and it already brings me the countries I expected

https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Iplocation#Updating_the_MMDB_file