Knowledge Management

Did Splunk Inc just get rid of Maxmind's free iplocation database and replace it with a different free product?

untieshoe
Path Finder

Did Splunk Inc just get rid of Maxmind's free iplocation database and replace it with a different free product (dbip-city-lite.mmdb)?

Am I the only one who thinks the accuracy of the IP lookups has gotten much worse with dbip-city-lite?

If this new database is to be believed, all my IP6 connections are coming from Texas, New York or Illianois and I work in Chicago (I don't).

Maxmind (free version that came with Splunk) was not 100%, but seemed to be much more accurate throughout the years I used it.

Anyone agree or disagree?

Labels (1)
0 Karma
1 Solution

untieshoe
Path Finder

I have subscribed to MaxMind and will use their MMDB instead.

Seems like I can even upload the file to Splunk Cloud.

I guess this will work. Thank you.

View solution in original post

0 Karma

untieshoe
Path Finder

I have subscribed to MaxMind and will use their MMDB instead.

Seems like I can even upload the file to Splunk Cloud.

I guess this will work. Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I haven't compared the new geolocation database with the old one so I can't comment on that.

You can, however, get a free Maxmind account, download their database, and install it in Splunk.  See https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Iplocation#Updating_the_IP_geoloc...

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...