https://community.splunk.com/t5/Splunk-Search/Problem-with-iplocation-showing-multiple-City-and-Country-fields/m-p/96545#M24939 <P>I'm getting unusual results when invoking the <STRONG>iplocation</STRONG> command (listed below). When the table is displayed it marks all results as Private IP space. However in the "other interesting fields" side bar I see multiple City/Country values with an interger appended. For example Country3 with 2 countries (Finland and United States). How can I correct the results of iplocation so that it consolidates City and Country into their respective fields?</P> <P>Query: </P> <PRE><CODE>sourcetype="pfsense_pf" fw_action="block" AND interface="vr1" | iplocation | table src_ip, City, Country </CODE></PRE> <P>Results:</P> <PRE><CODE>1 73.98.34.1 (Private Address) (Private Address) (XX) 2 73.98.34.1 (Private Address) (Private Address) (XX) 3 73.98.34.1 (Private Address) (Private Address) (XX) 4 73.98.34.1 (Private Address) (Private Address) (XX) 5 73.98.34.1 (Private Address) (Private Address) (XX) 6 73.98.34.1 (Private Address) (Private Address) (XX) 7 73.98.34.1 (Private Address) (Private Address) (XX) 8 73.98.34.1 (Private Address) (Private Address) (XX) 9 73.98.34.1 (Private Address) (Private Address) (XX) 10 73.98.34.1 (Private Address) (Private Address) (XX) Other interesting fields (42) City (1) City1 (1) City2 (1) City3 (2) City4 (1) City5 (6) City6 (1) City7 (3) City8 (1) Country (1) Country1 (1) Country2 (1) Country3 (2) Country4 (1) Country5 (2) Country6 (1) Country7 (2) Country8 (1) </CODE></PRE> Mon, 24 Oct 2011 00:30:12 GMT pstutz 2011-10-24T00:30:12Z https://community.splunk.com/t5/Splunk-Search/Problem-with-iplocation-showing-multiple-City-and-Country-fields/m-p/96545#M24939 <P>I'm getting unusual results when invoking the <STRONG>iplocation</STRONG> command (listed below). When the table is displayed it marks all results as Private IP space. However in the "other interesting fields" side bar I see multiple City/Country values with an interger appended. For example Country3 with 2 countries (Finland and United States). How can I correct the results of iplocation so that it consolidates City and Country into their respective fields?</P> <P>Query: </P> <PRE><CODE>sourcetype="pfsense_pf" fw_action="block" AND interface="vr1" | iplocation | table src_ip, City, Country </CODE></PRE> <P>Results:</P> <PRE><CODE>1 73.98.34.1 (Private Address) (Private Address) (XX) 2 73.98.34.1 (Private Address) (Private Address) (XX) 3 73.98.34.1 (Private Address) (Private Address) (XX) 4 73.98.34.1 (Private Address) (Private Address) (XX) 5 73.98.34.1 (Private Address) (Private Address) (XX) 6 73.98.34.1 (Private Address) (Private Address) (XX) 7 73.98.34.1 (Private Address) (Private Address) (XX) 8 73.98.34.1 (Private Address) (Private Address) (XX) 9 73.98.34.1 (Private Address) (Private Address) (XX) 10 73.98.34.1 (Private Address) (Private Address) (XX) Other interesting fields (42) City (1) City1 (1) City2 (1) City3 (2) City4 (1) City5 (6) City6 (1) City7 (3) City8 (1) Country (1) Country1 (1) Country2 (1) Country3 (2) Country4 (1) Country5 (2) Country6 (1) Country7 (2) Country8 (1) </CODE></PRE> Mon, 24 Oct 2011 00:30:12 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-iplocation-showing-multiple-City-and-Country-fields/m-p/96545#M24939 pstutz 2011-10-24T00:30:12Z https://community.splunk.com/t5/Splunk-Search/Problem-with-iplocation-showing-multiple-City-and-Country-fields/m-p/96546#M24940 <P>iplocation is actually a Python script. So you could make a custom version of the script, and have it return the results in a different way.</P> <P>There is more info in some of the other answers (such as <A href="http://splunk-base.splunk.com/answers/37249/specifying-field-w-iplocation?page=1&amp;focusedAnswerId=37370#37370">this one</A>) and in the Developer Manual</P> Sun, 01 Jan 2012 05:53:18 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-iplocation-showing-multiple-City-and-Country-fields/m-p/96546#M24940 lguinn2 2012-01-01T05:53:18Z