Is it possible to get the event source geo-localization directly from Splunk?

[thms35]

Hi,
I found many examples where lat/long are included in the events sent to the HEC, but is there a SPL API to get this information directly from Splunk?

Cheers

[kmaron]

If you have an IP address you can use iplocation

https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Iplocation

[thms35]

Thanks, we're going to check how it works.