When will Splunk upgrade iplocation database?

[cahuang]

Hi Splunk,

Which Iplocation database does Splunk use? Is it Maxmind? We find that the iplocation database which we are using is not the latest one. Does splunk team have any plan to upgrade? Or can our team upgrade on our own?

Thanks!

[dgoodwin1]

My last loc db update came with patching to 6.3.8. I notice I am no longer getting city name back on a lot of IP addresses so I tried the latest Maxmind db free dl. That new file seems to not work at all with 6.3.8. No results from iplocation not even country. I revert to the old version and I am back in business. Anyone know whats going on?
,I just tried pulling down the latest version from Maxmind and after updating iplocation no longer pulls back any data. Switching back to the old version of the db gets me working again. There is a note on the Maxmind dl page that they updated the format of the file. Is it possible my installation can not longer read the mmdb format? My last update came with patching to
6.3.8.

[richgalloway · Accepted solution]

Yes, Splunk uses the Maxmind iplocation database. The database is supposed to be updated with every new release of Splunk. Of course, that could mean waiting months for a location correction.

It is possible to update the database yourself. If you do that, however, Splunk will complain about an invalid file. If you can live with that, then check out https://answers.splunk.com/answers/123430/how-to-update-geoip-database-for-iplocation-command.html.

[cahuang]

Thanks. could you let me know when is next release? Generally when is your release date? Is it in regular plan?

[richgalloway]

I'm not a Splunker so I don't have access to the release schedule, but observation shows new version tend to come out every two months or so.