topic Re: In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1? in Splunk Search https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174377#M50025 <P>franks59 that field does not exist.</P> Wed, 30 Sep 2015 14:23:42 GMT cmlombardo 2015-09-30T14:23:42Z In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1? https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174375#M50023 <P>I set up a search on Splunk 6.0.1 that used the IPlocation command. In the output, I got field called CountryCode that contained a two letter country code associated with the Country. I've now upgraded to 6.2.3 and I no longer see CountryCode as part of the output when I run iplocation. What happened to CountryCode?</P> Wed, 24 Jun 2015 18:11:52 GMT https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174375#M50023 jedatt01 2015-06-24T18:11:52Z Re: In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1? https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174376#M50024 <P>I believe that is now _country_code</P> Tue, 29 Sep 2020 07:08:33 GMT https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174376#M50024 franks59 2020-09-29T07:08:33Z Re: In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1? https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174377#M50025 <P>franks59 that field does not exist.</P> Wed, 30 Sep 2015 14:23:42 GMT https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174377#M50025 cmlombardo 2015-09-30T14:23:42Z Re: In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1? https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174378#M50026 <P>I think the way to do this now is to set the option lang=code. That turns the Country field into the 2 char abbreviation and at least for US, the states abbreviation.</P> Mon, 15 Feb 2016 20:52:48 GMT https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174378#M50026 bawood 2016-02-15T20:52:48Z Re: In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1? https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174379#M50027 <P>bawood is correct! It works to use lang=code. </P> Wed, 04 May 2016 17:46:47 GMT https://community.splunk.com/t5/Splunk-Search/In-Splunk-6-2-3-what-happened-to-the-CountryCode-field-that-was/m-p/174379#M50027 jedatt01 2016-05-04T17:46:47Z