All Apps and Add-ons

Inconsistent Country returned by iplocation lookup

gordo32
Communicator

I recently deployed a new iplocation MMDB file using the cool method provided by Erik Horton here:
blog.hortonew.com/splunk-automatically-update-geoip-database-across-environment

However, I've noticed that sometimes, when I perform a lookup, I'll get different country results for the same IP address even within the same query. Specifically, I'm doing lookups against the IP addrs in my Okta logs, and it (mostly) comes up with Canada for the IP,


sourcetype="okta:im" action=success "action.categories{}"="Sign-in Success" targets{}.login=userid@domain.com
| iplocation src_ip
| eval Country=if(Country="","N/A",Country)| table _time, targets{}.login, src_ip, Country, City, Region
| sort _time

The result is:

_time,targets{}.login,src_ip,Country,City,Region
2018-02-20T18:56:29.000-0500,user@domain.com,38.21.25.x,Canada,Scarborough,Ontario
2018-02-21T08:50:41.000-0500,user@domain.com,38.21.25.x,Canada,Scarborough,Ontario
2018-02-22T11:33:28.000-0500,user@domain.com,38.21.25.x,Canada,Scarborough,Ontario
2018-02-23T09:13:32.000-0500,user@domain.com,38.21.25.x,United States,,
2018-02-24T23:54:53.000-0500,user@domain.com,38.21.25.x,Canada,Scarborough,Ontario
2018-02-25T00:18:17.000-0500,user@domain.com,38.21.25.x,Canada,Scarborough,Ontario
2018-02-25T00:24:04.000-0500,user@domain.com,38.21.25.x,Canada,Scarborough,Ontario
2018-02-25T22:01:21.000-0500,user@domain.com,38.21.25.x,Canada,Scarborough,Ontario

Particularly unusual is that it's always the same time entry that comes up as United States, while the rest come up as Canada.

Anyone know why this might be, or similar experience/solution?

0 Karma

gordo32
Communicator

Just to close this off since it's been resolved for a while... The issue was a typo in the path for the new mmdb file on the cluster peers. As a result, the peers were still using the mmdb that was in place before using the deployment server method and the first were not in sync. That @starcher for pointing me in the right direction.

0 Karma

starcher
SplunkTrust
SplunkTrust

Are you using search or index clustering?

0 Karma

gordo32
Communicator

Good question. I just made sure that the Cluster Master, Cluster Peers, and Search Head all have the updated MMDB file downloaded and in place. Any ideas what else might be the issue? Is there any way to validate which MMDB file is being used - just to make sure the limits.conf is taking effect from an app directory instead of etc/system/local?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...