Splunk Enterprise Security

Ip location return a wrong location after update db

saveriobocca
Loves-to-Learn Lots

Hi all,
I have Splunk ESS Version: 7.1.3.

After updating the GeoLite2-City.mmdb db (last 17/3/20) I noticed that in my query the location is still wrong.

Example:

index=network eventtype=cisco_vpn_start "AnyConnect parent session started." 
| where src_ip ="37.161.xx.xxx"
| iplocation src_ip 
| table src_ip, Country

src_ip  Country
37.161.xx.xxx   France

However when I running the following command:

| makeresults 
| eval ip="37.161.xx.xxx" 
| iplocation ip
| table Country, ip

Country   ip
Italy       37.161.xx.xxx

Why in one case is the correct value returned to me (Italy) while in the first case France appears to me?
The behavior is very anomalous to me 😞

Do you have any suggestion or fix for first query?

Thanks a lot,
Saverio

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...