topic Re: iplocation command not returning lat/lon fields (with allfields=true) in Splunk Search

iplocation command not returning lat/lon fields (with allfields=true)

adewinter — Mon, 28 Sep 2020 15:03:03 GMT

As in subject, I run the following command:

MY_SEARCH | iplocation allfields=true clientip | table lat lon

And the table is empty.

I have verified that clientip does contain values, and that other fields like "City", "City1" and "City2" contain values.

I've also found that the prefix=some_prefix_ option for the "iplocation" command does not work either.

Am I doing something wrong?

Re: iplocation command not returning lat/lon fields (with allfields=true)

krish3 — Wed, 12 Feb 2014 21:49:37 GMT

I have same problem did u get anything that fixed this issue?

Re: iplocation command not returning lat/lon fields (with allfields=true)

Lazarix — Fri, 14 Nov 2014 10:21:23 GMT

The right way to use this command is like:

|table c_ip | stats count by c_ip | iplocation c_ip

You can then visualise this on a map like:

|table c_ip | stats count by c_ip | iplocation c_ip | geostats latfield=lat longfield=lon sum(count) as count by c_ip globallimit=0

Re: iplocation command not returning lat/lon fields (with allfields=true)

SuganyaSSF — Fri, 07 Apr 2017 12:09:42 GMT

Hi ,

I am facing the similar and the above solution doesn't seem to work , do we have any way to get the location details based on the ip address in splunk

Re: iplocation command not returning lat/lon fields (with allfields=true)

jdanucalov1 — Fri, 03 Aug 2018 18:27:18 GMT

Doesn't work. As the poster mentioned the lat/lon fields aren't being produced at all by iplocation. I'm experiencing the same issue.

Re: iplocation command not returning lat/lon fields (with allfields=true)

moizmmz — Thu, 13 Dec 2018 21:31:47 GMT

I read in another answer that if the ip addresses are private, the command won't work. (quite obvious now that I think about it)