topic Re: iplocation query in Splunk Search

iplocation query: How to show the country with this search?

sulaimancds — Wed, 23 Aug 2023 19:50:08 GMT

when i run the above command , i am not able to get the country. country is blank.

| makeresults | eval myip="2001:4860:4860::8888" | iplocation myip

however, when i run this, it is able to show me the country. Can you help me to make the above first command work so that country will be shown?

Re: iplocation query

ITWhisperer — Wed, 23 Aug 2023 06:42:09 GMT

Does ClientIP hold a valid IP address?

Have you tried one of the IP addresses found in the ClientIP field in your makeresults line?

Re: iplocation query

sulaimancds — Wed, 23 Aug 2023 06:56:54 GMT

yes it is able to get the country i try it the the makeresults query

Re: iplocation query

gcusello — Wed, 23 Aug 2023 07:45:50 GMT

Hi @sulaimancds,

are you sure that the fieldname, after the spath command is exactly "ClientIP "?

Usually after a spath command, the field names are more complicated. probably you need to rename the field or use that field name in the iplocation command.

Ciao.

Giuseppe

Re: iplocation query

sulaimancds — Wed, 23 Aug 2023 07:58:45 GMT

@gcusello wrote:
Hi @sulaimancds,
are you sure that the fieldname, after the spath command is exactly "ClientIP "?
Usually after a spath command, the field names are more complicated. probably you need to rename the field or use that field name in the iplocation command.

Ciao.

Giuseppe

HI it does not work, this is my original command before inserting. IPLocation

example

userid ClientIP displayname

abc@gamil.com 1.1.1.1 abcpc

need help work to show country of the ClientIP

Re: iplocation query

gcusello — Wed, 23 Aug 2023 08:10:12 GMT

Hi @sulaimancds,

as I said, the usual issue is that the field name used in the iplocation command isn't exactly the one you have from your logs, for this reason I hinted to check the field names,

also because the spath command has always field names more structured (e.g. event.access.ip{}), but if your search extracts the ClientIP you could try to use it.

Ciao.

Giuseppe

Re: iplocation query

sulaimancds — Wed, 23 Aug 2023 08:15:07 GMT

hi i try with iplocation ClientIP it does not work

Re: iplocation query

gcusello — Wed, 23 Aug 2023 08:21:28 GMT

Hi @sulaimancds,

please check if in the interesting fields there is another alias of the ClientIP (having the same value) and try to use it.

Ciao.

Giuseppe