Can you provide instructions on how to manually update the geoip database? Maxmind has more current databases (as current as May 2012) and the database included with the app is from Sept 2010.
If you want to upgrade the database:
1. Go to: http://www.maxmind.com/en/geolite
2. Download the GeoLiteCity database in binary format
3. Unzip the package
4. Replace the existing database file in $SPLUNK_HOME\etc\apps\MAXMIND\bin\
If you want to upgrade the database:
1. Go to: http://www.maxmind.com/en/geolite
2. Download the GeoLiteCity database in binary format
3. Unzip the package
4. Replace the existing database file in $SPLUNK_HOME\etc\apps\MAXMIND\bin\
