Did Splunk Inc just get rid of Maxmind's free iplocation database and replace it with a different free product?

[untieshoe]

Did Splunk Inc just get rid of Maxmind's free iplocation database and replace it with a different free product (dbip-city-lite.mmdb)?

Am I the only one who thinks the accuracy of the IP lookups has gotten much worse with dbip-city-lite?

If this new database is to be believed, all my IP6 connections are coming from Texas, New York or Illianois and I work in Chicago (I don't).

Maxmind (free version that came with Splunk) was not 100%, but seemed to be much more accurate throughout the years I used it.

Anyone agree or disagree?

[untieshoe · Accepted solution]

I have subscribed to MaxMind and will use their MMDB instead.

Seems like I can even upload the file to Splunk Cloud.

I guess this will work. Thank you.

[richgalloway]

I haven't compared the new geolocation database with the old one so I can't comment on that.

You can, however, get a free Maxmind account, download their database, and install it in Splunk.  See https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Iplocation#Updating_the_IP_geoloc...